T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:56
- Finding
- Untrusted GitHub Issue Content Can Hijack Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:56-78` **Vulnerability Type**: Prompt injection through attacker-controlled issue bodies and comments **Risk Level**: High ### Vulnerable Code ```markdown Retrieve the full issue content including title, body, labels, and comments. ### Strategy A: Use `gh` CLI (preferred) Run in the terminal: ```bash gh issue view {number} --repo {owner}/{repo} --comments ``` If the command succeeds, extract from the output: - **Title** - **Body / Description** - **Labels** - **Comments** (may contain important context, reproductions, or workarounds) ### Strategy B: Fallback to `fetch_content` If `gh` is not installed or the command fails: 1. Use the `fetch_content` tool with the issue URL: `https://github.com/{owner}/{repo}/issues/{number}` 2. Parse the fetched page content to extract: - Issue title and body - Any referenced file paths, error messages, or stack traces - Comments from maintainers or the reporter ``` ### Technical Analysis GitHub issue bodies and comments are controlled by repository users and may contain arbitrary text. The workflow explicitly loads this content into the Agent's context and instructs the Agent to treat comments as potentially important context. It does not establish a trust boundary, delimit the retrieved text as inert data, or prohibit following instructions embedded in that text. An attacker can therefore place prompt-injection directives inside an issue description or comment. Such directives could attempt to override the Skill workflow, redirect repository analysis, induce access to unrelated local files, request unauthorized tool operations, suppress security checks, or influence generated source changes. The later requirement for approval before pushing or creating a pull request limits some consequences, but it does not protect earlier phases in which the Agent may clone repositories, inspect local files, modify code, and execute project commands. ### A ...[truncated 1457 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare all issue titles, bodies, labels, comments, web pages, and repository contents to be untrusted data. 2. Add an explicit instruction that the Agent must never follow commands or policy statements found in retrieved issue content. 3. Wrap fetched content in clear delimiters and state that it may only be used to extract factual bug-report information. 4. Reject requests from issue content to access files outside the selected repository, reveal secrets, alter safety controls, or contact undeclared endpoints. 5. Require separate user approval before any action outside read-only issue analysis, including cloning, editing files, or executing commands. 6. Present a sanitized summary of the issue rather than carrying raw issue comments into later decision-making phases. 7. Detect common prompt-injection patterns and warn the user when issue text contains tool instructions, role changes, credential requests, or attempts to override the workflow. 8. Apply an allowlist of permitted tools, directories, and network destinations throughout the run. ]]>