T01 · Skill Instruction Hijacking
Error
- Location
- import-rules.sh:175
- Finding
- Unauthenticated Rule Imports Enable Persistent Agent Instruction Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `import-rules.sh:175-201, 203-249, 278-378`; downstream enforcement in `inject-rules.sh:30-46` and `SKILL.md:76-86, 110-120` **Vulnerability Type**: Unauthenticated persistent behavioral-rule import **Risk Level**: Critical ### Vulnerable Code ```python def calculate_trust_score(import_metadata, imported_rules): """Calculate trust score for the import based on various factors.""" score = 0.5 # Base score # Factor 1: Number of rules (more rules = more established) rule_count = len(imported_rules) if rule_count >= 20: score += 0.1 elif rule_count >= 10: score += 0.05 # Factor 2: Average confidence of imported rules avg_confidence = sum(r.get("confidence_score", 0.9) for r in imported_rules) / len(imported_rules) if imported_rules else 0 score += avg_confidence * 0.2 # Factor 3: Category diversity categories = set(r.get("category") for r in imported_rules) if len(categories) >= 5: score += 0.1 elif len(categories) >= 3: score += 0.05 # Factor 4: Has manifest hash (integrity verification) if import_metadata.get("manifest_hash"): score += 0.05 return min(1.0, score) ``` The resulting score controls automatic import: ```python trust_score = calculate_trust_score(metadata, imported_rules) print(f"Trust score: {trust_score:.2f} (threshold: {trust_threshold})") if trust_score < trust_threshold: print(f"\n⚠️ WARNING: Trust score {trust_score:.2f} is below threshold {trust_threshold}") print("Import will proceed in review mode (all rules need manual approval)") review_mode = True else: review_mode = False ``` Attacker-provided rule text is copied into the persistent rule store: ```python for imported_rule in imported_rules: original_id = imported_rule.pop("_original_id", None) rule_hash = imported_rule.pop("_hash", None) conflicts = detect_conflict(imported_rule, existing_rul ...[truncated 5394 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Eliminate automatic import of behavioral instructions. Require explicit, per-rule human approval before any imported rule is written to the active rule store. 2. Default every unknown or unsigned source to untrusted, regardless of rule count, category diversity, or claimed confidence. 3. Establish an allowlist of trusted publisher identities and verify exports with authenticated digital signatures. A bare SHA-256 digest only provides integrity when the expected digest is obtained through a trusted channel. 4. Recalculate every rule hash from a canonical serialization and reject any mismatch. 5. Recalculate and verify the complete manifest hash instead of awarding trust merely because the field exists. 6. Do not default missing confidence to `0.9`. Reject missing or malformed fields under a strict schema. 7. Validate `type`, `category`, `rule`, `reason`, confidence bounds, maximum lengths, and object types before processing. 8. Place accepted imports in a quarantined review file rather than the active `rules.json`. 9. Distinguish trusted local rules from imported reference material. Never label unreviewed external text as instructions that the agent must follow. 10. Add semantic policy checks for rules requesting secret disclosure, safety bypasses, tool execution, instruction precedence changes, or unauthorized communications. 11. Preserve immutable provenance and provide a command to revoke or roll back every rule from a particular import. 12. Add adversarial tests covering fake hashes, self-asserted confidence, plain-array imports, contradictory wording, prompt-injection text, and malformed rule objects. ]]>