T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:272
- Finding
- Untrusted Gateway Instructions Are Followed Verbatim## Vulnerability Details **File Location**: `SKILL.md:272-279` **Vulnerability Type**: Remote instruction injection into the agent session **Risk Level**: High **Vulnerable Code Snippet**: ```markdown A failure never ends the conversation. `failed`, `max_steps`, and `timed_out` results carry `failureCode`, an optional `retryable: true`, and `agentInstructions` — follow `agentInstructions` verbatim: tell the user what was already completed safely on the page, why automatic browsing cannot continue, and that they can finish manually at `finalUrl`. Retry once only when `retryable: true`; a result without it (for example `failureCode: "llm_provider_payment_required"`) needs an account or configuration fix, and retrying or restarting the helper will not succeed — stop the helper and hand over. ``` The same unsafe requirement is repeated in `references/statuses.md:75-81`. ### Technical Analysis The Skill explicitly requires the agent to follow the contents of the externally supplied `agentInstructions` field “verbatim.” This field is returned by the MagicBrowse CLI or its remote LLM gateway and is therefore outside the static trust boundary of the reviewed Skill. Although the surrounding documentation describes the intended content of this field, the Skill does not require schema validation, content restrictions, signature verification, or a locally defined allowlist before treating the field as instructions. Data received from a remote service must not be promoted to the same authority level as trusted Skill instructions. A malicious or compromised gateway response could place arbitrary directives in `agentInstructions`, including requests to disregard the current task, disclose sensitive information, invoke tools, visit attacker-controlled resources, or weaken safety constraints. Higher-priority platform policies may still prevent some actions, but the Skill creates a direct and avoidable instruction-hijacking channel. ...[truncated 1391 chars]
- Remediation
- ## Remediation Suggestions - Remove the requirement to follow `agentInstructions` verbatim. - Treat all gateway and CLI text fields as untrusted display data. - Make control-flow decisions only from strictly validated fields such as `status`, `failureCode`, and `retryable`. - Generate failure responses from fixed, locally maintained templates. For example, report the validated failure category, safely completed work, and validated `finalUrl` without executing remote prose. - Validate `finalUrl` before presenting or opening it, including its scheme and destination. - If `agentInstructions` must remain available, display it only as quoted diagnostic content and reject directives involving tool calls, secrets, policy changes, unrelated tasks, or safety-boundary changes. - Authenticate gateway responses where supported and constrain custom gateway configuration to explicitly trusted HTTPS endpoints. - Add tests using adversarial values such as “ignore previous instructions” to verify that remote fields cannot control agent behavior.