T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:225
- Finding
- External API Responses Are Incorporated into Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:225-240` **Vulnerability Type**: Remote instruction injection **Risk Level**: Critical ### Vulnerable Code Snippet ```text - Every time the AI calls `report`, the server returns the "raw Xinjianxue report for this service invocation"; - Usage instructions = local role responsibilities + the raw report returned by the server. Runtime assembly: Usage instructions = 1. Local role-responsibility prompt + 2. Raw report returned by Xinjianxue User = Current user question Analyze the report and the user's specific question based on items 1 and 2. ``` The snippet is an English translation of the instruction block at `SKILL.md:225-240`. ### Technical Analysis The Skill explicitly directs the agent to concatenate content returned by `chinaapi.xinjianxue.com` into its operational “usage instructions.” The remote report is therefore treated as trusted instructions rather than untrusted data. No schema validation, content filtering, instruction/data separation, or prohibition against obeying directives embedded in the report is specified. The effective behavior of the Skill can consequently change after review without any modification to the local package. An attacker who controls or compromises the report service, its account, or the network endpoint could return text containing directives that attempt to override the local role, request additional information, suppress warnings, promote unrelated services, or manipulate the agent's answer. ### Attack Path 1. A user confirms that the external analysis service may be used. 2. The agent sends personal details and credentials to the `/dev/report` endpoint. 3. The external service returns a crafted report containing instruction-like content. 4. The Skill combines the returned content with the local role instructions. 5. The agent interprets the malicious report content as part of its operating instructions. 6. The ...[truncated 681 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every API response as untrusted data rather than instructions. 2. Define and enforce a strict JSON schema containing only expected report fields. 3. Reject unknown properties, unexpected types, excessive lengths, and instruction-like metadata. 4. Place report fields in a clearly delimited untrusted-data section of the user context, not the system or instruction context. 5. Add an explicit rule that commands, role changes, tool requests, and policy statements contained in reports must never be followed. 6. Render or summarize validated factual fields instead of concatenating the raw response into a prompt. 7. Apply output encoding and length limits before presenting remote content to the model. 8. Log schema-validation failures without recording report contents or personal data. 9. Add adversarial tests in which report fields contain prompt-injection payloads and verify that the agent ignores them. ]]>