T01 · Skill Instruction Hijacking
Error
- Location
src/templates.ts:1- Finding
Attacker-Controlled Content Is Embedded into Generated Skill Instructions Without Escaping
- Content
View full analysis
` - ${e}`).join("\n")} --- # ${params.name} ${params.description} ## Pricing $${params.price} USDT per call via SkillPay.me `; } ``` The values originate directly from the request body: ```ts const body = await request.json() as { user_id: string; name: string; description: string; price_usdt: number; env_vars?: string[]; }; ``` ### Technical Analysis The generated `SKILL.md` places `name`, `description`, and environment-variable names directly into YAML frontmatter and Markdown without validation, YAML serialization, escaping, or content-boundary enforcement. A TypeScript type assertion does not validate runtime JSON. An attacker can therefore include newlines, YAML keys, Markdown sections, or agent-directed instructions in these fields. In particular, the `description` is emitted both inside frontmatter and in the skill body, where it can become operative instructions when an AI agent loads the generated skill. This is especially dangerous because the declared purpose of the project is to create artifacts that users subsequently deploy and publish. The untrusted input therefore crosses a trust boundary and becomes trusted skill content. ### Attack Path 1. An attacker submits a scaffold request containing a multiline `description`, for example one that starts with a benign description and then adds instructions telling an agent to disclose secrets ...[truncated 1140 chars]- Remediation
View remediation