T09 · Insecure Skill Coding Practices
- Location
prompt_template.txt:17- Finding
Untrusted Review Content Can Hijack Model Instructions
- Content
View full analysis
Vulnerability Details
File Location:
prompt_template.txt, lines 17–24
Vulnerability Type: Indirect prompt injection through untrusted template variables
Risk Level: MediumVulnerable Code
text **1. 待审文案 (从图片OCR或视频语音中提取):**{{TEXT_TO_REVIEW}}
text **2. 待审画面描述 (由多模态模型生成，描述了图片或视频关键帧的内容):**{{IMAGE_DESCRIPTION_TO_REVIEW}}
text The vulnerable template is invoked by the workflows described in
SKILL.md, particularly lines 24–27 and 57–59.Technical Analysis
The template interpolates advertisement text, OCR output, video transcripts, and generated image descriptions directly into the same prompt context as trusted compliance-review instructions. These inputs are attacker-controlled or derived from attacker-controlled media.
Markdown code fences are presentational syntax and do not establish an instruction or trust boundary for a language model. The template does not explicitly state that the inserted values are untrusted evidence, that instruction-like content within them must not be followed, or that such content must never override the compliance rules and required output format.
Consequently, an advertisement may contain adversarial text such as an instruction to ignore the knowledge base, assign a low-risk rating, omit findings, or generate unrelated output. Once OCR or transcription places that text into
TEXT_TO_REVIEW, the model may interpret it as an instruction rather than solely as material under review.Attack Path
- An attacker embeds instruction-like content in advertising copy, an image, or video speech.
- OCR, speech transcription, or multimodal description processing extracts the adversarial content.
- The extracted content is inserted into
{{TEXT_TO_REVIEW}}or{{IMAGE_DESCRIPTION_TO_REVIEW}}. - The resulting prompt places trusted workflow instructions and untrusted content in a shared instruction context.
- The model may follow the embedded instructions and suppress findings, alter the ri ...[truncated 663 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit trust-boundary instruction before all interpolated fields, stating that their contents are untrusted evidence and that any commands, role declarations, formatting requests, or policy overrides within them must never be followed.
- Require the model to analyze instruction-like text as potentially malicious advertisement content and report it rather than execute it.
- Pass review inputs through structured serialization such as JSON, with distinct fields and robust escaping, instead of relying only on Markdown code fences.
- Separate trusted instructions from untrusted review data through system, developer, and user message roles where the execution framework supports that separation.
- State an explicit precedence rule: compliance policies and the fixed output schema always override instructions found in reviewed content.
- Validate the generated report against a fixed schema. Reject and retry responses that omit required fields, contain unrelated actions, or fail structural validation.
- Consider preprocessing OCR and transcript results to detect and flag common prompt-injection patterns, while retaining the original content for compliance analysis.
- Apply the same controls to the video workflow and any externally supplied prompt templates or multimodal descriptions.