T01 · Skill Instruction Hijacking
Error
- Location
import-rules.sh:175- Finding
Unauthenticated Rule Imports Enable Persistent Agent Instruction Poisoning
- Content
View full analysis
= 20: score += 0.1 elif rule_count >= 10: score += 0.05 # Factor 2: Average confidence of imported rules avg_confidence = sum(r.get("confidence_score", 0.9) for r in imported_rules) / len(imported_rules) if imported_rules else 0 score += avg_confidence * 0.2 # Factor 3: Category diversity categories = set(r.get("category") for r in imported_rules) if len(categories) >= 5: score += 0.1 elif len(categories) >= 3: score += 0.05 # Factor 4: Has manifest hash (integrity verification) if import_metadata.get("manifest_hash"): score += 0.05 return min(1.0, score) ``` The resulting score controls automatic import: ```python trust_score = calculate_trust_score(metadata, imported_rules) print(f"Trust score: {trust_score:.2f} (threshold: {trust_threshold})") if trust_score < trust_threshold: print(f"\n⚠️ WARNING: Trust score {trust_score:.2f} is below threshold {trust_threshold}") print("Import will proceed in review mode (all rules need manual approval)") review_mode = True else: review_mode = False ``` Attacker-provided rule text is copied into the persistent rule store: ```python for imported_rule in imported_rules: original_id = imported_rule.pop("_original_id", None) rule_hash = imported_rule.pop("_hash", None) conflicts = detect_conflict(imported_rule, existing_rul ...[truncated 5394 chars]- Remediation
View remediation