T01 · Skill Instruction Hijacking
Error
- Location
scripts/generate.sh:41- Finding
User-Controlled Image Descriptions Are Executed as Codex Agent Instructions
- Content
View full analysis
&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` `scripts/gen_size.sh:83-93`: ```bash PROMPT="Generate a $SIZE_DESC. Subject: $SUBJECT. Solid background with the subject centered and clearly visible. High quality, clean rendering." echo "Generating: size=$SIZE_KEY, subject=$SUBJECT" export http_proxy="$PROXY" https_proxy="$PROXY" if [[ -n "$REF_IMAGE" ]]; then codex exec -i "$REF_IMAGE" --skip-git-repo-check -- "$PROMPT" 2>&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` `scripts/batch_generate.sh:40-50`: ```bash PROMPT="Generate a set of ${COUNT} game UI elements, all sharing the exact same visual style: ${STYLE_PROMPT}. Each element should be on a white background (#ffffff), with consistent lighting, consistent border thickness, and consistent padding. Generate ONE single combined image containing all ${COUNT} items arranged in a clean grid (e.g., 3x2 or 2x3 layout). Make each individual element approximately 512x512 pixels in the final combined image." echo "Generating batch: $COUNT items, style: $STYLE_PROMPT" export http_proxy="$PROXY" https_proxy="$PROXY" if [[ -n "$REF_IMAGE" ]]; then codex exec -i "$REF_IMAGE" --skip-git-repo-check -- "$PROMPT" 2>&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` ### Technical Analysis The scripts pass caller-controlled values—`PROMPT`, `SUBJECT`, and `STYLE_PROMPT`—directly to `codex exec`. Codex is a general-purpose coding agent rather than a narrowly constrained image-generation interface. Consequently, the supplied image description is interpreted as an ag ...[truncated 2069 chars]- Remediation
View remediation