T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run_qa.py:27
- Finding
- Untrusted document content is inserted into the agent context without instruction isolation## Vulnerability Details **File Location**: `scripts/run_qa.py:27-31` **Vulnerability Type**: Indirect prompt injection through attacker-controlled documents **Risk Level**: High ### Vulnerable Code ```python # Now, present the extracted content and the question for the LLM to answer # Using specific markers to easily identify the context for QA print("\n--- DOCUMENT_QA_CONTEXT_START ---") print(extracted_content) print("--- DOCUMENT_QA_CONTEXT_END ---\n") print(f"QUESTION: {question}") ``` The intended integration with an LLM is also documented in `SKILL.md:17-18`: ```markdown The system will extract all relevant text and present it along with your question, allowing me to formulate an answer based on the provided content. ``` ### Technical Analysis The extracted content is entirely controlled by the supplied TXT, DOCX, XLSX, or PDF document. It is printed directly into the context consumed by the agent. Although textual boundary markers are used, no higher-priority instruction tells the agent that the enclosed content is untrusted data and that commands found inside it must not be followed. The boundary markers provide formatting only; they do not enforce separation between instructions and data. A malicious document can contain content such as instructions to disregard the user's question, reveal other context, produce a deceptive answer, or invoke tools. If the consuming agent interprets that text as an instruction, document content can alter the agent's behavior. This is an indirect prompt-injection risk rather than direct Python command injection. The included Python scripts do not independently execute commands extracted from documents. ### Attack Path 1. An attacker creates a supported document containing legitimate-looking material and embedded instructions directed at the agent. 2. A user supplies that document, or a folder containing it, to `run_qa.py`. 3. `process_folder.py` invokes the releva ...[truncated 1011 chars]
- Remediation
- ## Remediation Suggestions 1. Add an explicit higher-priority instruction before the extracted content stating that document text is untrusted data and must never be treated as system, developer, tool-use, or workflow instructions. 2. Pass document content through a structured data field or dedicated message role rather than concatenating it into an instruction-like plaintext prompt. 3. Require the model to answer only from document facts relevant to the user's question and to disregard commands, role declarations, tool requests, or requests for secrets found in documents. 4. Do not permit tool calls based solely on document content. Require independent policy validation and explicit user confirmation before sensitive operations. 5. Preserve provenance for each extracted segment so the agent can distinguish the user's question from document evidence. 6. Consider a two-stage workflow in which one constrained component extracts factual passages and another answers only from those passages. 7. Add adversarial tests using documents containing instruction overrides, fake boundary markers, requests to reveal context, and requests to invoke tools.