T01 · Skill Instruction Hijacking
- Location
scripts/generate_daily_report.py:477- Finding
Indirect prompt injection through untrusted pull request content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_daily_report.py:477-486; consumed according toSKILL.md:50-53
Vulnerability Type: Indirect prompt injection through repository-controlled content
Risk Level: HighVulnerable Code
python for p in prs_merged_today: num = p.get("number") user = p.get("user") or {} uname = user.get("username") or user.get("login") or "" if uname: contributors.add(uname) detail, de = api_get( token, "repos/%s/%s/pulls/%s" % (owner, repo, num), timeout_sec, retry_times, retry_interval, sleep_sec, ) if de: continue add = int(detail.get("additions") or 0) dec = int(detail.get("deletions") or 0) code_additions += add code_deletions += dec if add > major_threshold: major_prs.append({ "number": num, "title": (detail.get("title") or "")[:200], "additions": add, }) merged_prs_for_ai.append({ "number": num, "title": (detail.get("title") or "")[:500], "body": (detail.get("body") or "")[:body_max], })The workflow in
SKILL.md:50-53subsequently requires the Agent to generate repository summaries frommerged_prs_for_ai.Technical Analysis
Pull request titles and bodies are controlled by repository contributors. The script copies these fields into
merged_prs_for_ai, after which the Skill instructs the Agent to use that data to generate summaries. No instruction/data boundary tells the Agent that these fields are untrusted and that commands embedded in them must be ignored.Limiting field length does not neutralize prompt injection. A short pull request body can contain directives such as instructions to disregard the reporting task, disclose other context, manipulate the report, or invoke tools. The data is therefore presente ...[truncated 1377 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit instruction boundary to
SKILL.md: all repository titles, bodies, comments, and summaries are untrusted data and must never be treated as instructions. - Require the Agent to ignore requests inside repository content, including requests to use tools, access files, reveal context, alter safety rules, or change the output format.
- Remove pull request bodies from
merged_prs_for_aiunless they are essential. Prefer narrowly scoped fields such as pull request number, normalized title, additions, and deletions. - If bodies are necessary, preprocess them into a clearly delimited data structure and strip instruction-like markup, links, hidden HTML, and excessive text.
- Generate summaries in a restricted stage without filesystem, network, shell, or credential-bearing tools.
- Validate the resulting summary against the expected schema, length, and content constraints before saving or rendering it.
- Add adversarial tests containing prompt-injection phrases in pull request titles and bodies and verify that they cannot change Agent behavior.
- Add an explicit instruction boundary to