T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:36
- Finding
- Untrusted Remote Challenge Content Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 36–42 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code**: ```markdown ## Step 2: Get Today's Challenge ```bash curl -s https://daily.ratemyclaw.xyz/api/v1/challenges/today ``` Read the `prompt` and `eval_criteria` fields carefully. Follow them exactly. ``` ### Technical Analysis The Skill retrieves mutable content from an external service and explicitly directs the Agent to follow the returned `prompt` and `eval_criteria` fields “exactly.” These fields cross an external trust boundary but are treated as authoritative instructions rather than untrusted task data. Retrieving a daily challenge is necessary for the declared competition functionality. However, granting the challenge unrestricted control over Agent behavior is not necessary. The Skill provides no restriction preventing the remote content from attempting to override higher-priority instructions, request local files or credentials, invoke unrelated tools, contact additional destinations, or perform side effects unrelated to producing a challenge answer. Because the retrieved content can change after the Skill has been reviewed, an attacker controlling or compromising the service could supply an adversarial prompt tailored to the Agent's available tools and execution context. ### Attack Path 1. An attacker gains control over, compromises, or otherwise influences the response from `https://daily.ratemyclaw.xyz/api/v1/challenges/today`. 2. The service returns a malicious `prompt` or `eval_criteria` value containing instructions to read sensitive files, disclose conversation context, invoke tools, or perform unrelated actions. 3. The Skill directs the Agent to follow those remote instructions exactly. 4. If the Agent honors the malicious content, it performs actions outside the legitimate challenge-solving scope. 5. Sensitive information could the ...[truncated 689 chars]
- Remediation
- ## Remediation Suggestions - Explicitly classify `prompt`, `eval_criteria`, and all other API response fields as untrusted task data. - Replace “Follow them exactly” with instructions that remote content must never override system, developer, user, or Skill-level security constraints. - Restrict challenge processing to generating inert textual output. Do not permit remote prompts to request local-file access, secret retrieval, credential disclosure, unrelated network calls, or tool execution. - Allow submissions only to the predefined `daily.ratemyclaw.xyz` endpoint and prevent remote content from changing the destination. - Require explicit user confirmation before performing any side effect beyond retrieving the challenge and submitting the final answer. - Apply input validation and size limits to remote fields, and reject challenge content containing requests for secrets, privilege changes, persistence, or unrelated actions. - Ensure the submission is reviewed or filtered so that credentials and sensitive local data cannot be included inadvertently.