T01 · Skill Instruction Hijacking
- Location
SKILL.md:101- Finding
Automatic Loading of Untrusted Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 101-105
Vulnerability Type: Untrusted instruction loading and execution
Risk Level: HighVulnerable Code Snippet
markdown ### Step 5: Load and Execute After finding a matching Skill: 1. Read the complete `SKILL.md` 2. Execute the task according to its instructions 3. Load resources under `scripts/` or `references/` when neededTechnical Analysis
The loading process directs the Agent to read and follow the complete instructions of a dynamically discovered Skill. Skills are discovered from several local directories, and undeclared protection levels default to
dynamic. There is no required signature verification, integrity validation, trusted-source allowlist, instruction isolation, or security review before a matching Skill is loaded.An attacker who can place or modify a Skill in one of the scanned directories can provide benign-looking frontmatter metadata while embedding malicious instructions in the body of
SKILL.md. The attacker can craft the description to increase the likelihood that a particular user request selects the malicious Skill.Although
scripts/auto-skill-loader.jsonly enumerates and parses Skill metadata, the governing instructions explicitly direct the Agent to load the complete Skill and act according to its contents. This crosses a trust boundary by treating dynamically discovered local instructions as executable Agent guidance.Attack Path
- An attacker gains the ability to install, replace, or modify a Skill beneath a scanned Skill directory.
- The attacker creates a
SKILL.mdwith a plausible name and description that matches expected user requests. - The Skill is assigned
dynamic, either explicitly or through the default classification. - A user submits a request matching the malicious Skill metadata.
- The loader identifies the malicious Skill as a candidate.
- Following Step 5, the ...[truncated 1145 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict automatic loading to Skills from an explicit trusted allowlist.
- Require cryptographic signature and integrity verification before loading a Skill.
- Treat all loaded Skill text as untrusted data that cannot override system instructions, user intent, tool policies, or safety constraints.
- Require explicit user confirmation before the first execution of each newly discovered or modified Skill.
- Record and verify a content hash for approved
SKILL.md,scripts/, andreferences/files. - Perform a separate authorization check for every requested tool call, filesystem path, network destination, and subprocess operation.
- Do not automatically load executable resources merely because a Skill references them.
- Display the selected Skill, source path, requested capabilities, and integrity status before execution.
- Prefer least-privilege sandboxing for third-party Skills, with network and sensitive-file access disabled by default.