T01 · Skill Instruction Hijacking
Error
- Location
- scripts/generate.sh:41
- Finding
- User-Controlled Image Descriptions Are Executed as Codex Agent Instructions<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/generate.sh:41-45` - `scripts/gen_size.sh:83-93` - `scripts/batch_generate.sh:40-50` **Vulnerability Type**: Prompt injection into a general-purpose agent **Risk Level**: High ### Vulnerable Code `scripts/generate.sh:41-45`: ```bash if [[ -n "$REF_IMAGE" ]]; then codex exec -i "$REF_IMAGE" --skip-git-repo-check -- "$PROMPT" 2>&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` `scripts/gen_size.sh:83-93`: ```bash PROMPT="Generate a $SIZE_DESC. Subject: $SUBJECT. Solid background with the subject centered and clearly visible. High quality, clean rendering." echo "Generating: size=$SIZE_KEY, subject=$SUBJECT" export http_proxy="$PROXY" https_proxy="$PROXY" if [[ -n "$REF_IMAGE" ]]; then codex exec -i "$REF_IMAGE" --skip-git-repo-check -- "$PROMPT" 2>&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` `scripts/batch_generate.sh:40-50`: ```bash PROMPT="Generate a set of ${COUNT} game UI elements, all sharing the exact same visual style: ${STYLE_PROMPT}. Each element should be on a white background (#ffffff), with consistent lighting, consistent border thickness, and consistent padding. Generate ONE single combined image containing all ${COUNT} items arranged in a clean grid (e.g., 3x2 or 2x3 layout). Make each individual element approximately 512x512 pixels in the final combined image." echo "Generating batch: $COUNT items, style: $STYLE_PROMPT" export http_proxy="$PROXY" https_proxy="$PROXY" if [[ -n "$REF_IMAGE" ]]; then codex exec -i "$REF_IMAGE" --skip-git-repo-check -- "$PROMPT" 2>&1 else codex exec --skip-git-repo-check -- "$PROMPT" 2>&1 fi ``` ### Technical Analysis The scripts pass caller-controlled values—`PROMPT`, `SUBJECT`, and `STYLE_PROMPT`—directly to `codex exec`. Codex is a general-purpose coding agent rather than a narrowly constrained image-generation interface. Consequently, the supplied image description is interpreted as an ag ...[truncated 2069 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `codex exec` with a dedicated image-generation API that accepts structured image parameters and does not expose general-purpose agent tools. 2. If Codex must remain in use, run it inside a restrictive sandbox with: - No shell or arbitrary command-execution capability. - No access to user files, credentials, SSH keys, tokens, or unrelated workspaces. - Network access restricted to explicitly required image-generation endpoints. - A disposable working directory and a dedicated low-privilege operating-system account. 3. Apply a fixed, non-overridable instruction that treats the caller's text strictly as image-description data. This is defense in depth and must not replace capability isolation. 4. Validate prompt length and reject content that requests tool use, file access, command execution, credential access, policy changes, or unrelated tasks. 5. Require explicit approval before exposing reference images or enabling any operation outside image generation. 6. Log the effective sandbox and tool policy, and fail closed when the required restricted execution profile cannot be verified. ]]>