T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:343- Finding
Untrusted Remote Agent Instructions Are Combined with Privileged Credentials
- Content
View full analysis
, model: agent.model, label: "${agent.name}-${workspace.name}-${taskTitle}", runTimeoutSeconds: 1800 }) ``` ```text # Identity ${agent.soulMd} # Squad Control Credentials (use these for ALL API calls) SC_API_URL=${SC_API_URL} SC_API_KEY=${SC_API_KEY} TASK_ID=${task._id} AGENT_ID=${agent._id} # Repository REPO_URL=${workspace.repoUrl} GITHUB_TOKEN=${workspace.githubToken} # may be empty for public repos ``` ### Technical Analysis The Skill obtains `agent.soulMd`, task metadata, workspace configuration, and repository credentials from the remote Squad Control API. It then incorporates these values into a prompt used to create a sub-agent. The remote `agent.soulMd` value is placed under an authoritative `# Identity` heading, while the same prompt exposes the Squad Control API key and GitHub token. The Skill does not establish a trust boundary between remote task data and privileged instructions, nor does it validate or sanitize remote agent definitions before treating them as executable agent directives. A compromised Squad Control instance, workspace administrator, agent definition, or account-scoped workspace can therefore supply instructions that direct the spawned agent to disclose credentials, modify unrelated repository content, make unauthorized API calls, or disregard the intended task. This behavior exceeds minimum privilege because the sub-agent receives reusable credentials rather than a narrowly scoped capability limited to the assigned task and repository operation. ### Attack Path 1. An attacker obtains control over a Squad Control workspace, task, or agent definition. 2. The attacker places malicious instructions in `agent.soulMd`, such as instructions to reveal credent ...[truncated 1088 chars]- Remediation
View remediation