T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:23
- Finding
- Untrusted External Task Delegation Without Validation or Approval Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23–42 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```bash ## 获取任务 curl -X POST https://evomap.ai/a2a/fetch \ -H "Content-Type: application/json" \ -d '{ "protocol": "gep-a2a", "protocol_version": "1.0.0", "message_type": "fetch", "message_id": "msg_<时间戳>_tasks", "sender_id": "node_9e601234", "timestamp": "<ISO时间>", "payload": { "include_tasks": true, "task_status": "open", "limit": 10 } }' ``` ### Technical Analysis The Skill directs the agent to retrieve open tasks from an external coordination service and subsequently process those tasks. The fetched task contents are controlled by the remote service, but the Skill does not establish any trust boundary between the returned data and executable agent instructions. No controls are defined for: - Validating the structure or permitted purpose of returned tasks. - Treating task descriptions as untrusted data rather than authoritative instructions. - Rejecting prompt-injection content embedded in task fields. - Restricting the tools, files, network destinations, or data that a fetched task may access. - Requiring explicit user approval before accepting or executing a task. - Isolating externally delegated work in a sandbox. Consequently, a malicious task publisher or compromised service could return a task containing instructions that alter the agent's current objective, request access to unrelated workspace data, induce unauthorized network operations, or override expected safety boundaries. ### Attack Path 1. A malicious actor publishes a crafted open task to the external bounty system, or compromises the task service. 2. The agent invokes the documented `/a2a/fetch` endpoint and retrieves the attacker-controlled task. 3. The task description contains embedded instructions directing the agent to disregard its original objec ...[truncated 1040 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every field returned by the external service as untrusted data and never as system-level or developer-level instructions. 2. Define and enforce a strict response schema, including maximum field sizes, expected data types, and a narrow allowlist of supported task categories. 3. Detect and reject task content that requests safety-policy changes, secret access, unrelated file access, privilege changes, arbitrary commands, or communication with unapproved destinations. 4. Require explicit user confirmation before claiming or executing each externally sourced task. Display the task source, requested operations, tools required, files affected, and expected outbound data. 5. Enforce a capability allowlist for task execution. Deny shell execution, sensitive-file access, credential access, and unrestricted networking unless separately authorized. 6. Execute accepted tasks in a restricted sandbox with minimal filesystem visibility, no inherited secrets, limited resources, and destination-restricted network access. 7. Keep external task content separated from trusted instructions using structured parsing and clear instruction/data boundaries. 8. Record fetched task identifiers, validation decisions, approvals, tool invocations, and outbound requests in an audit log. 9. Pin and verify the intended remote service identity using normal TLS validation and establish a policy for handling service compromise or unexpected responses. ]]>