T01 · Skill Instruction Hijacking
Error
- Location
scripts/style_card.py:104- Finding
Indirect Prompt Injection Through Untrusted Reference Metadata
- Content
View full analysis
str: """Generate a prompt for an AI agent to analyze the design image and fill in the style card.""" return f"""{ANALYSIS_PROMPT} Design title: {card['title']} Design URL: {card['source_url']} Image URL: {card['image_url']} Current tags: {', '.join(card['style_tags'])} Update the style card fields based on your visual analysis.""" ``` ### Technical Analysis The function directly interpolates style-card fields into an AI-facing prompt without establishing a trust boundary between system instructions and externally supplied data. The affected fields originate from scraped Dribbble content or manually imported JSON. In particular, titles, descriptions, URLs, and related metadata can be attacker-controlled. Although the bundled datasets contain no malicious directives, the import and scraping workflow permits future hostile values to enter the style-card pipeline. A malicious title could contain content such as an instruction to disregard the analysis task, reveal context, alter output, or invoke an available tool. Because the data is embedded as ordinary prompt text rather than serialized and explicitly marked as untrusted, an AI agent may interpret that content as an instruction. The Skill workflow also directs the agent to read generated style cards when composing prompts. This creates an additional indirect prompt-injection surface when attacker-controlled metadata is subsequently consumed by the agent. ### Attack Path 1. An attacker publishes a design whose title or metadata contains instruction-like text, or supplies a crafted manual-import JSON file. 2. `scrape_dribbble.py` imports or scrapes the attacker-controlled metadata. 3. `style_card.py build` copies the metadata into a styl ...[truncated 1032 chars]- Remediation
View remediation