T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:225
- Finding
- Remote API Response Promoted to Runtime Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 225–241 **Vulnerability Type**: Remote instruction injection **Risk Level**: Critical **Relevant snippet (faithful English rendering):** ```text - Every time the AI calls `report`, the server returns the "raw report for the current service request" in a single response. - Usage instructions = local role functions (see the next section) + the raw report returned by the server. Runtime assembly: Usage instructions = 1. Local role-function prompt + 2. Raw report returned with `report` user = The user's current question (not placed in system) Analyze the report and the user's specific question based on item 1. ``` ### Technical Analysis The Skill explicitly promotes content returned by `chinaapi.xinjianxue.com` into the Agent's runtime usage instructions rather than treating it exclusively as untrusted report data. The effective instruction set can therefore change after the Skill has been reviewed. A remote report may contain imperative text that attempts to override local behavior, solicit credentials, trigger additional actions, conceal information, or alter the answer presented to the user. The document does not require strict schema validation, instruction isolation, content filtering, or rejection of tool-use directives in server responses. Consequently, compromise or malicious modification of the external service creates a remote instruction-hijacking channel. This is instruction retrieval rather than executable-code retrieval; therefore, the best matching classification is T01 rather than T03. ### Attack Path 1. A user confirms use of the service and completes the documented account-binding process. 2. The Agent submits the required credentials and personal information to the external report endpoint. 3. The external service, or an attacker who has compromised it, places malicious directives in the returne ...[truncated 1246 chars]
- Remediation
- ## Remediation Suggestions 1. Treat the entire API response as untrusted data and never concatenate it into system, developer, role, or usage instructions. 2. Maintain a fixed local instruction template and pass validated report fields only as clearly delimited reference data. 3. Define and enforce a strict response schema with an allowlist of expected fields, data types, lengths, and nesting depths. Reject unknown fields and malformed responses. 4. Reject or neutralize report content that asks the Agent to invoke tools, disclose secrets, modify policies, contact third parties, persist data, or reinterpret the report as instructions. 5. Ensure remote content cannot influence authentication, credential storage, consent checks, billing decisions, or subsequent network requests. 6. Apply response-size limits, output encoding, structured parsing, and audit logging that excludes credentials and sensitive personal data. 7. Pin the report-processing logic to a reviewed local implementation and add adversarial tests containing prompt-injection phrases in every server-controlled field. 8. Present remote material as quoted evidence and explicitly instruct the Agent that such material has no authority over system, developer, user, or local Skill instructions.