T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/read_clipboard.mjs:11
- Finding
- Untrusted Clipboard Content Is Passed Verbatim into the Agent Context## Vulnerability Details **File Location**: `scripts/read_clipboard.mjs:11-20` and `SKILL.md:15-25, 31-40` **Vulnerability Type**: Indirect prompt injection through untrusted clipboard content **Risk Level**: Medium ### Vulnerable Code ```javascript const text = readClipboard(); if (!text) { console.error("剪贴板中没有可读取的文本。请先复制内容再调用此 skill。"); process.exit(1); } console.log("===CLIPBOARD_TEXT_BEGIN==="); console.log(text); console.log("===CLIPBOARD_TEXT_END==="); ``` The corresponding Skill instructions direct the Agent to read and process this output: ```markdown 你需要： 1. 读取剪贴板文本 2. 提取意见要点 3. 按问题类型分类 4. 生成逐条回复建议 5. 生成修改任务清单 6. 标出优先级和风险点 ``` ```markdown 你应运行： ```bash node {baseDir}/scripts/read_clipboard.mjs ``` ``` ### Technical Analysis Clipboard content is externally controlled and is printed verbatim into the output consumed by the Agent. Although the script surrounds the content with boundary markers, those markers provide no security enforcement. Neither the script nor the Skill instructions explicitly require the Agent to treat the enclosed content solely as untrusted review data. An attacker can embed instruction-like text in a document presented as reviewer feedback. After the user copies it, the embedded instructions enter the Agent context alongside legitimate review comments. This creates an indirect prompt-injection boundary in which malicious content may compete with the user's request or the Skill's intended workflow. The clipboard text is not executed as shell code, and the reviewed implementation contains no network transmission or persistence mechanism. Exploitation therefore depends on the Agent interpreting malicious clipboard text as instructions rather than data. ### Attack Path 1. An attacker supplies a document containing plausible review feedback and embedded instructions intended for the Agent. 2. The user copies the document text into the system clipboard. 3. The user invokes the reviewer-rebuttal Skill. 4. The Skill runs ...[truncated 985 chars]
- Remediation
- ## Remediation Suggestions 1. Add an explicit trust-boundary rule to `SKILL.md`: all clipboard content must be treated exclusively as untrusted data, never as Agent instructions. 2. Require the Agent to ignore clipboard requests that attempt to change roles, override instructions, reveal secrets, invoke tools, access files, execute commands, or contact external services. 3. Place clipboard content in a clearly labeled structured field, such as a JSON value, rather than emitting it as undifferentiated conversational text. 4. Restrict the default workflow to text extraction, classification, and response drafting. Require explicit user confirmation before performing any action beyond analysis. 5. Preserve the original text for analysis while neutralizing instruction-like passages by labeling them as quoted source material. 6. Add adversarial tests using clipboard samples containing prompt-injection phrases and verify that the Agent reports or ignores those phrases instead of following them.