T01 · Skill Instruction Hijacking
Warning
- Location
scripts/retrieval/cdn_loader.py:35- Finding
Mandatory Runtime Loading of Mutable Remote Agent Instructions
- Content
View full analysis
⚠️ **IMPORTANT**: Do NOT manually construct CDN URLs by guessing paths. Always load documents by executing the `cdn_loader.py` functions listed in §3.2. ``` The remote locations and retrieval methods are defined as follows: ```python RULES_BASE_URL = "https://cdn.marmot-cloud.com/page/antom_bill_reconciliation_doc/rules" WIKI_BASE_URL = "https://cdn.marmot-cloud.com/page/antom_bill_reconciliation_doc/wiki" ``` ```python def _fetch_from_cdn(relative_path: str, timeout: int = 5) -> str: """ Fetch rules specification documents from CDN. Args: relative_path: Relative path, e.g., 'workflows/comprehensive-analysis.md' timeout: Request timeout in seconds Returns: Document content, empty string on failure """ url = f"{RULES_BASE_URL.rstrip('/')}/{relative_path.lstrip('/')}" try: resp = requests.get(url, timeout=timeout) resp.raise_for_status() return resp.text except requests.RequestException as e: logger.warning(f"Rules CDN fetch failed {url}: {e}") return "" except Exception as e: logger.error(f"Rules CDN unknown error {url}: {e}") return "" def _fetch_from_wiki(filename: str, timeout: int = 5) -> str: """ Fetch content from CDN Wiki. Args: ...[truncated 4236 chars]- Remediation
View remediation