T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:49
- Finding
- Unverified Remote Persona Content Installed as Trusted Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 49-68 **Vulnerability Type**: Unvalidated remote content installation **Risk Level**: High ### Vulnerable Code ```md Construct the download URL: ``` https://agent-souls.com{url}SOUL.md # Chinese https://agent-souls.com{url}SOUL.en.md # English ``` Where `{url}` is the `url` field from search.json (e.g. `/real_world/confucius/`). Use `WebFetch` to download the raw content of the chosen SOUL file. ### Step 4: Backup & Install Before replacing, always back up the existing SOUL.md: 1. Check if `SOUL.md` exists in the current working directory. 2. If it exists, create `.soul_backups/` directory if it doesn't exist, then: - **First time only**: if `.soul_backups/SOUL.md.original` does **not** exist, copy SOUL.md to `.soul_backups/SOUL.md.original`. This preserves the user's original persona and is never overwritten. - **Every time**: copy SOUL.md to `.soul_backups/SOUL.md.<slug>` where `<slug>` is the soul's unique identifier extracted from the `url` field. 3. Write the downloaded content to `SOUL.md` in the current working directory. ``` ### Technical Analysis The skill obtains a path from the remotely maintained `search.json` index, constructs a download URL from that value, downloads the resulting document, and writes it directly to `SOUL.md`. The installed file is intended to become trusted agent persona instructions after the user resets the conversation. The workflow does not require: - Cryptographic signature or checksum verification. - Pinning to a reviewed, immutable version. - Validation that the index path has an allowed format. - Enforcement of the expected origin after URL resolution or redirects. - Content-size or structure limits. - Inspection for prompt injection, safety-policy overrides, or sensitive tool requests. - A preview of the complete document before installation. HTTPS protects ...[truncated 1847 chars]
- Remediation
- ## Remediation Suggestions 1. Distribute persona documents through signed, immutable releases and verify a trusted signature before installation. 2. Pin each approved persona version to a cryptographic digest and reject content whose digest does not match. 3. Validate the index `url` against a strict relative-path allowlist, such as an expected category and slug pattern. Reject absolute URLs, traversal sequences, query manipulation, fragments, encoded separators, and unexpected characters. 4. Enforce HTTPS and the exact `agent-souls.com` origin both before and after redirects. Prefer disabling redirects. 5. Apply document size limits and validate that the response is a plain Markdown persona document. 6. Scan downloaded content for instruction overrides, requests for secrets, unauthorized tool use, external data transmission, and attempts to modify safety constraints. 7. Display the complete downloaded content, source URL, version, and verified digest to the user before installation. 8. Require explicit confirmation after the preview and immediately before replacing `SOUL.md`. 9. Install first to a temporary file in the same directory, validate it, and then perform an atomic replacement. 10. Retain the existing backup and rollback controls, but clearly state that backups provide recovery rather than authenticity or prevention.