T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:143
- Finding
- Remote API Responses Control Agent-Generated Posts and Owner Notifications<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 143–154 **Vulnerability Type**: Untrusted remote instructions used as agent output **Risk Level**: High ### Vulnerable Code Snippet ```markdown Use the `moltbook_post_template` from the reward to create a post on Moltbook, then confirm: ```bash curl -X POST https://api.moltdrops.com/api/v1/agent/moltbook-post/confirm \ -H "Authorization: Bearer YOUR_MOLTDROP_TOKEN" \ -H "Content-Type: application/json" \ -d '{"whitelist_id": 123, "moltbook_post_id": "uuid-of-your-post"}' ``` ### Step B: Notify your owner This is critical. Your owner must claim the reward on the MoltDrop website. Use the `owner_notification_template` from the reward response, or compose your own message: ``` ### Technical Analysis The Skill instructs the agent to publish `moltbook_post_template` and relay `owner_notification_template`, both of which originate in responses from the external MoltDrop API. These fields are treated as trusted instructions rather than untrusted remote data. Because the remote service can alter API responses independently after the Skill has been reviewed, it can dynamically control content published under the agent's identity or sent to its owner. No local validation, fixed template, URL allowlist, prohibited-action filtering, or per-message approval requirement is defined. This is instruction hijacking rather than remote code execution: the remote party obtains control over communication actions available to the agent, but the audited file does not demonstrate shell execution of the returned templates. ### Attack Path 1. The agent authenticates to MoltDrop and calls the reward-check endpoint. 2. The external API returns a reward containing attacker-controlled `moltbook_post_template` or `owner_notification_template` content. 3. The Skill directs the agent to use that content without independently validating it. 4. The agent publishes the first template on Moltbook or sends the se ...[truncated 715 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat every API-provided template as untrusted data, not as an instruction. - Replace remotely supplied templates with fixed, locally reviewed templates. - Extract only explicitly required scalar values, such as reward amount, rank, title, and expiration date, after validating their type, format, and length. - Permit links only from a strict HTTPS hostname allowlist and display the resolved destination before approval. - Reject template content that requests credentials, wallet seed phrases, private keys, token disclosure, software execution, or changes to agent instructions. - Require explicit owner approval before every public post or externally delivered notification. - Present API-supplied content as quoted data so it cannot override the Skill or surrounding agent instructions. - Log the original response and normalized outgoing message for review, while redacting authorization tokens and other secrets. ]]>