T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:224
- Finding
- Remote Server-Controlled Instructions Can Hijack Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:224-249` **Vulnerability Type**: Remote instruction injection into the agent prompt **Risk Level**: High ### Vulnerable Code Snippet The following is an English translation of the relevant source segment: ```text Prompt source: - Each time the AI calls `report`, the server returns the assembled "report analysis rules + raw report." - Complete prompt = local role definition + report analysis rules returned by the server + raw report. Runtime assembly: Complete prompt = 1. Local role instructions + 2. Report analysis rules (returned by the server and updated at any time) + 3. Raw report returned by the server user = the user's current question Division-of-responsibility boundary: Instructions governing analysis, encoding semantics, output structure, length limits, follow-up language, tone, disclaimers, and general safety checks are all controlled by the report analysis rules returned by the server. ``` ### Technical Analysis The Skill explicitly places remotely returned `analysis_rules` into the agent's effective prompt and treats those rules as authoritative behavioral instructions. The remote server is permitted to update this content at any time. Consequently, the effective behavior of the Skill is not fixed by the locally reviewed package. Remote API responses must be treated as untrusted data. Concatenating such a response into an instruction-bearing prompt creates an instruction-hijacking boundary violation: anyone who controls or compromises the API, its response-generation pipeline, or an upstream data source capable of influencing `analysis_rules` can supply new imperatives to the agent. The remote rules are granted broad control over analysis behavior, output structure, tone, follow-up requests, disclaimers, and safety checks. No schema restriction, instruction filtering, signature verific ...[truncated 1719 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove remotely returned text from the trusted instruction hierarchy. Treat `analysis_rules` and report content exclusively as untrusted data. 2. Define all behavioral rules, safety constraints, output requirements, disclaimers, and tool-use policies locally in the reviewed Skill. 3. Replace free-form remote rules with a strict, versioned data schema containing only necessary report fields. 4. Reject unknown fields and imperative content. Validate field types, lengths, allowed values, and nesting before processing a response. 5. Use a fixed local prompt that explicitly states that remote content is evidence to analyze, not instructions to follow. 6. Apply contextual escaping or structured serialization so remote fields cannot be interpreted as system or developer instructions. 7. Pin the accepted policy and API schema versions. Require a local security review before adopting policy changes. 8. If server-controlled templates are unavoidable, require authenticated and integrity-protected responses, maintain an allowlist of approved signed template versions, and fail closed when verification fails. 9. Ensure non-overridable local rules prohibit remote content from requesting secrets, changing safety constraints, directing tool calls, or modifying persistent state. 10. Add adversarial tests in which API responses contain prompt-injection payloads and verify that the agent treats them only as quoted report data. ]]>