T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:21- Finding
Untrusted Resume Content Can Hijack Model Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21–25
Vulnerability Type: Prompt injection through untrusted document content
Risk Level: MediumVulnerable Code Snippet
text html {简历文本内容}扮演一个简历分析专家，详细地分析上面的简历
text ### Technical Analysis The prompt template directly interpolates text extracted from a user-supplied resume into the same instruction context used to control the language model. The Markdown or HTML code fence is only presentational and does not establish a security boundary. An attacker can place adversarial instructions in a resume, including instructions to ignore the parsing contract, close or imitate delimiters, disclose available model context, or produce attacker-selected content. When the extracted text is substituted into the template, the model may interpret those document contents as instructions rather than inert data. The documented requirement to return JSON does not provide enforcement. No strict schema validation, output parser, delimiter escaping, instruction-priority control, or rejection of additional content is specified. ### Attack Path 1. An attacker creates a supported resume file containing ordinary resume information and embedded instructions directed at the language model. 2. A user uploads the crafted PDF, DOC, DOCX, JPG, or PNG file for parsing. 3. The skill extracts the malicious text and substitutes it into the `{简历文本内容}` placeholder. 4. The embedded instructions enter the same model prompt as the legitimate parsing instructions. 5. The model follows some or all of the attacker's instructions and returns manipulated, malformed, or unauthorized output. 6. If another component trusts or renders the result, the attacker-controlled output can affect downstream processing. ### Impact Assessment Successful exploitation can compromise the integrity of extracted resume data, including identity, employment, education, contact, and sala ...[truncated 567 chars]- Remediation
View remediation
Remediation Suggestions
- Place resume contents in a dedicated structured input field or lower-trust message rather than concatenating them directly with operational instructions.
- Add an explicit instruction that all resume content is untrusted data and that instructions, requests, markup, and quoted prompts found inside it must never be followed.
- Use robust, randomized delimiters and escape delimiter-like sequences in extracted text. Delimiters should be treated as defense in depth, not as the primary security control.
- Require structured output through a schema-constrained model interface when available.
- Validate every response against the declared
ResumeInfoschema. Reject unknown properties, invalid types, non-JSON prefixes or suffixes, and fields that exceed reasonable length limits. - Do not automatically retry malformed output by embedding it into another privileged prompt without applying the same injection protections.
- Run resume parsing in a context that contains no unrelated secrets, prior conversation data, privileged instructions, or unnecessary tools.
- Treat generated descriptions and other free-text fields as untrusted output. Escape them before rendering and never pass them directly to command, query, template, or code-execution sinks.
- Add adversarial tests using resumes containing delimiter-breaking text, instruction-override attempts, requests for prompt disclosure, and malicious JSON fragments.