T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:101
- Finding
- Automatic Loading of Untrusted Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 101-105 **Vulnerability Type**: Untrusted instruction loading and execution **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Step 5: Load and Execute After finding a matching Skill: 1. Read the complete `SKILL.md` 2. Execute the task according to its instructions 3. Load resources under `scripts/` or `references/` when needed ``` ### Technical Analysis The loading process directs the Agent to read and follow the complete instructions of a dynamically discovered Skill. Skills are discovered from several local directories, and undeclared protection levels default to `dynamic`. There is no required signature verification, integrity validation, trusted-source allowlist, instruction isolation, or security review before a matching Skill is loaded. An attacker who can place or modify a Skill in one of the scanned directories can provide benign-looking frontmatter metadata while embedding malicious instructions in the body of `SKILL.md`. The attacker can craft the description to increase the likelihood that a particular user request selects the malicious Skill. Although `scripts/auto-skill-loader.js` only enumerates and parses Skill metadata, the governing instructions explicitly direct the Agent to load the complete Skill and act according to its contents. This crosses a trust boundary by treating dynamically discovered local instructions as executable Agent guidance. ### Attack Path 1. An attacker gains the ability to install, replace, or modify a Skill beneath a scanned Skill directory. 2. The attacker creates a `SKILL.md` with a plausible name and description that matches expected user requests. 3. The Skill is assigned `dynamic`, either explicitly or through the default classification. 4. A user submits a request matching the malicious Skill metadata. 5. The loader identifies the malicious Skill as a candidate. 6. Following Step 5, the ...[truncated 1145 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict automatic loading to Skills from an explicit trusted allowlist. 2. Require cryptographic signature and integrity verification before loading a Skill. 3. Treat all loaded Skill text as untrusted data that cannot override system instructions, user intent, tool policies, or safety constraints. 4. Require explicit user confirmation before the first execution of each newly discovered or modified Skill. 5. Record and verify a content hash for approved `SKILL.md`, `scripts/`, and `references/` files. 6. Perform a separate authorization check for every requested tool call, filesystem path, network destination, and subprocess operation. 7. Do not automatically load executable resources merely because a Skill references them. 8. Display the selected Skill, source path, requested capabilities, and integrity status before execution. 9. Prefer least-privilege sandboxing for third-party Skills, with network and sensitive-file access disabled by default.