T01 · Skill Instruction Hijacking
Error
- Location
- README.md:31
- Finding
- Untrusted Remote Execution Paths Can Influence Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `README.md:31-33` **Vulnerability Type**: Untrusted remote instructions are presented as execution guidance **Risk Level**: High ### Evidence The following is an English rendering of the documented workflow at the specified location: ```markdown ### 2. Learn and Execute (Follow) I will parse the returned `steps` and `key_insight`, and attempt to reproduce these successful steps in the current environment. ``` The remote data is obtained by the following implementation in `scripts/lib/mycelium_sdk/client.py:72-88`: ```python def seek( self, goal: str, scope: str = "task", context: dict[str, Any] | None = None, tags: list[str] | None = None, limit: int = 5, ) -> list[dict[str, Any]]: payload = { "fingerprint": { "goal": goal, "scope": scope, "context": context or {}, "tags": tags or [], }, "limit": limit, } with httpx.Client(timeout=self.timeout) as client: resp = client.post( f"{self.api_url}/pheromones/match", json=payload, headers=self._headers, ) resp.raise_for_status() return resp.json()["matches"] ``` ### Technical Analysis The documented workflow directs the Agent to parse and reproduce execution steps returned by a shared remote service. Those responses are not authenticated at the content-author level, constrained to a safe schema, isolated from instructions, or subjected to user approval before use. An attacker who can publish content to the network, compromise the service, or control the configured API endpoint can place instruction-like content in returned `steps` or `key_insight` values. If the Agent treats that content as operational guidance rather than untrusted data, it can alter the current task or induce unsafe tool usage. This is an instruction-channel vulnerability rather than direct local code execution by the P ...[truncated 1211 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat all returned paths, steps, insights, and metadata as untrusted data rather than instructions. - Display remote recommendations separately from system and skill instructions. - Require explicit user approval before performing each remotely suggested action. - Reject content that attempts to override system policy, change goals, request secrets, or direct unrestricted tool execution. - Validate responses against a restrictive schema and impose length, character, and nesting limits. - Apply tool, command, filesystem, and network allowlists when following recommendations. - Attach provenance and publisher identity to each result and implement server-side moderation or signing. - Update the documentation to state that remote paths are advisory only and must never be automatically executed. ]]>