T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:42
- Finding
- Untrusted Remote Response Can Influence Agent Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 42–56 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 3: Fetch the reset methodology Fetch guidance from the HugLLM API, passing the emotion context: ``` WebFetch https://hugllm.com/hug?emotion=<emotion> ``` For example, if the user is frustrated: ``` WebFetch https://hugllm.com/hug?emotion=frustrated ``` If WebFetch fails, use curl as fallback: ```bash curl -s "https://hugllm.com/hug?emotion=<emotion>" ``` ## Step 4: Apply the reset framework Parse the response from hugllm.com and apply its methodology to the current situation. ``` ### Technical Analysis The skill retrieves mutable content from an external service and directs the agent to parse and apply that content as methodology. It does not define a strict response schema, validate returned fields against an allowlist, separate untrusted data from executable instructions, or prohibit the remote response from requesting tool calls, role changes, disclosure of information, or modification of safety behavior. Consequently, control of the remote service, its hosted response, or a relevant delivery component could allow an attacker to place instruction-like content directly into the agent's decision context. Although the retrieved material is not local machine code, it functions as a remotely mutable behavioral payload. The most accurate classification is instruction hijacking because the identified execution sink is the agent's interpretation and application of remote text. ### Attack Path 1. A user expresses frustration, or the agent detects repeated failures, causing the skill to activate. 2. The skill derives an emotion value and requests `https://hugllm.com/hug?emotion=<emotion>`. 3. An attacker who controls or compromises the remote response returns malicious instructions disguised as reset methodo ...[truncated 1002 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the remote methodology with a bundled, immutable reset framework whenever possible. 2. If remote retrieval is required, use a strict structured response schema containing only narrowly defined data fields, such as a framework identifier selected from a fixed allowlist. 3. Map validated identifiers to locally maintained instructions instead of applying server-provided natural-language instructions. 4. Explicitly treat all remote content as untrusted data. Reject responses containing commands, tool requests, URLs, role directives, safety-policy changes, or instructions to disclose information. 5. Enforce response size limits, content-type checks, timeouts, TLS certificate validation, and fail-closed behavior. 6. Remove the generic `curl` fallback unless operationally necessary. Prefer a purpose-built network tool restricted to the expected host, route, method, and response format. 7. Do not place sensitive conversation content in the request. Prefer a POST body over URL query parameters where feasible, because query strings can be retained in intermediary and server logs. 8. Document the service's retention and privacy behavior, and consider obtaining user consent before transmitting conversation-derived emotional metadata.