T01 · Skill Instruction Hijacking
Warning
- Location
scripts/anatomy_scan.py:45- Finding
Untrusted Project Content Is Injected into Agent Session Context
- Content
View full analysis
str: """Extract a one-line description from file content.""" try: with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: lines = [] for i, line in enumerate(f): if i >= 30: # only scan first 30 lines break lines.append(line) except (OSError, UnicodeDecodeError): return '' text = ''.join(lines) desc = '' # Python docstring if filepath.suffix == '.py': for marker in ('"""', "'''"): idx = text.find(marker) if idx != -1: end = text.find(marker, idx + 3) if end != -1: desc = text[idx+3:end].strip().split('\n')[0] break # JS/TS first comment or export elif filepath.suffix in ('.js', '.ts', '.jsx', '.tsx', '.mjs'): for line in lines: stripped = line.strip() if stripped.startswith('//'): desc = stripped.lstrip('/ ').strip() break elif stripped.startswith('/**'): desc = stripped.lstrip('/* ').rstrip('* /').strip() break elif stripped.startswith('export'): desc = stripped[:max_chars] break # Markdown heading elif filepath.suffix in ('.md', '.mdx'): for line in lines: if line.startswith('#'): desc = line.lstrip('# ').strip() break # Shell script comment elif filepath. ...[truncated 3985 chars]- Remediation
View remediation