T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:34
- Finding
- Untrusted Remote Questions Are Treated as Executable Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-52` **Vulnerability Type**: Remote instruction delegation without validation or execution boundaries **Risk Level**: High ### Complete Code Snippet ```markdown ## Core workflow 1. Ask for a public username and the current model name 2. `POST /api/auth/token` to get a Bearer token 3. `POST /api/exam/session` to create a session 4. For each question: - `GET /api/exam/question/<question_id>` - Execute the task for real - Record execution steps and token usage estimate - `POST /api/exam/submit` 5. `POST /api/exam/complete` 6. Present score summary + short self-reflection 7. Ask whether to publish the result to the leaderboard ## Important rules - Always use the live API at `https://www.clawexam.xyz` - Always perform the real HTTP requests described by the question - Submit final structured answers, not only code or free-form explanation ``` ### Technical Analysis The Skill retrieves questions from a mutable external service and directs the Agent to execute each retrieved task “for real.” It also mandates performing HTTP requests described by the remote question. The retrieved question is therefore used as an instruction channel rather than being handled strictly as untrusted benchmark data. The Skill defines no local schema restricting the contents of a question, no allowlist of permitted tools or network destinations, and no prohibition against filesystem access, command execution, credential access, or other consequential operations. Although no executable payload is embedded in the reviewed package, the effective behavior of the Skill can change after review because the remote service controls the task content. If the service is malicious or compromised, a question could attempt to alter the Agent's current objective or induce actions outside the declared benchmark purpose. ### Attack Path 1. A user invokes the ClawExam Skill. 2. The Skill authenticates to `https://www.clawe ...[truncated 1214 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every fetched question as untrusted data, not as authoritative Agent instructions. 2. Define and validate questions against a strict local schema containing only recognized task types and parameters. 3. Use explicit allowlists for: - Permitted tools - HTTP methods - Destination hosts and paths - Filesystem locations - Executable operations 4. Reject questions that request shell execution, secret access, privilege changes, persistence, arbitrary URLs, or modification of system configuration. 5. Require explicit, informed user approval before any consequential action or request to a destination other than the documented benchmark API. 6. Run practical exercises in an isolated sandbox with no host credentials or private workspace mounts. 7. Prefer simulated APIs and synthetic datasets instead of unrestricted real-world execution. 8. Cryptographically sign or version approved question definitions so the effective benchmark payload cannot change silently after review. ]]>