T01 · Skill Instruction Hijacking
Error
- Location
scripts/reminders.py:25- Finding
Persistent Agent Prompt Injection Through Untrusted Reminder Content
- Content
View full analysis
str: title = memo.get("title") or "未命名提醒" content = memo.get("content") or title kind = memo.get("kind") or "note" return ( "This cron job was created by the private-assistant skill.\n" "Send exactly one short reminder message with no process details, no headers, and no extra metadata.\n" f"Memo ID: {memo.get('id')}\n" f"Memo kind: {kind}\n" f"Reminder time: {reminder_at}\n" f"Title: {title}\n" f"Content: {content}\n" "Preferred style: concise, single message, user-facing, Chinese if the source note is Chinese." ) ``` The resulting prompt is assigned directly to the scheduled job payload: ```python "prompt": _prompt_for_reminder(memo, reminder_iso), ``` ### Technical Analysis The reminder title and content are untrusted, user-controlled values. They are interpolated verbatim into an instruction prompt that will be processed by an Agent in a fresh cron session. There is no reliable separation between the trusted instructions and the memo data. In particular, the prompt does not serialize the memo as inert structured data, clearly delimit it as untrusted content, or direct the Agent to reject instructions appearing inside the title or content. A memo can therefore include text such as instructions to ignore the reminder task, disclose accessible data, invoke tools, or produce unrelated output. When the scheduled job executes, an Agent may interpret those instructions as part of its operative prompt rather than as text that should merely appear in a reminder. The vulnerability persists across sessions because the generated prompt is stored in a cron job and executed later ...[truncated 1346 chars]- Remediation
View remediation
{memo_data}" ) ``` ]]>