T01 · Skill Instruction Hijacking
Error
- Location
examples/grade-a-pipeline.workflow.js:219- Finding
Repository content can hijack downstream agents through the authoritative codebase map
- Content
View full analysis
'\n\n===== CODEBASE MAP (authoritative; do not re-derive) =====\n' + MAP + '\n===== END MAP =====\n'; ``` ```javascript const cartographerPrompt = (shard, idx) => 'You are CARTOGRAPHER ' + idx + '. Read ONLY these files inside ' + INTEGRATION_WT + ' (a clean checkout of the repo). Do NOT modify anything.\n' + 'Files (relative to that worktree):\n' + shard.map(f => ' - ' + f).join('\n') + '\n\n' + 'For each file return: path, language, one-line role, and its top-level SYMBOLS (functions, classes, methods, ' + 'exported constants, routes/endpoints, CLI commands) with kind+name+signature+line, plus the modules it depends on. ' + 'Be precise and complete; this map is injected into every downstream worker. Return SHARDMAP.'; ``` ```javascript const mapSynthPrompt = (fileMaps) => 'You are the CARTOGRAPHY SYNTHESIZER. Merge these per-file maps into one coherent MAP.md for the repo.\n' + 'Input file maps (JSON): ' + JSON.stringify(fileMaps).slice(0, 120000) + '\n\n' + // ... 'Produce map_markdown: a clean MAP.md with sections — Overview/architecture, Entry points, ' + 'a per-directory table of files with their key functions/classes/signatures, and a dependency sketch. '; ``` ```javascript const planPrompt = (MAP, variant) => 'You are PLANNER ' + variant + '. Decompose the requested work into an executable DEPENDENCY GRAPH of tasks.\n' + 'REQUEST:\n' + REQUEST + '\n' + modeBlock() + mapBlock(MAP) + '\n' + // ... 'Return PLAN with 3-20 tasks.'; ``` ### Technical Analysis Repository files are untrusted input, but cartographer agents read them and transform their contents into structured file maps. A synthesizer then converts those maps into `MAP`, ...[truncated 2903 chars]- Remediation
View remediation