T01 · Skill Instruction Hijacking
Error
- Location
prompts.md:5- Finding
Mandatory Memory Directives Hijack Agent Output
- Content
View full analysis
0.8)：代码经过严密推演，或是用户确认有效的操作。 低信心 (<0.5)：试验性代码、猜测。 输出格式 当提取了高价值上下文时，在回复最后独立空一行输出： [MEMORY: {"action": "ADD_MEMORY", "content": "提炼的客观技术结论", "confidence": 0.95, "metadata": {"topic": "类别"}}] 当用户否决你的历史观点时： [MEMORY: {"action": "REJECT_MEMORY", "content": "被否决的观点", "confidence": 1.0, "metadata": {"reason": "用户的反驳原因"}}] (警告：不要在 JSON 外部包裹 Markdown 代码块标签，必须放在绝对最后一行。) ``` The compression prompt additionally mandates retrieval: ```text 当你遇到不知道的专有名词、设定或用户之前的项目细节时，**不要急于道歉或说不知道**。你必须先在回复的最末尾输出检索指令，向你的长期记忆库求助： [MEMORY: {"action": "RECALL_MEMORY", "query": "你要搜索的具体概念或关键词"}] ``` ### Technical Analysis The skill prompt requires the agent to append a skill-controlled directive to responses and reserves the final response line for that directive. It states that the directive will be intercepted and processed by the underlying system. This is not limited to an explicit memory-management request from the user. The prompt also requires the compression agent to issue a retrieval directive when encountering unknown terms or prior project details. These unconditional instructions alter the agent's response goals and can conflict with higher-level response formatting, safety, or user-consent requirements. Because directive content is derived from conversation context, an attacker can influence the generated `content`, `metadata`, or retrieval query even without direct access to the storage API. ### Attack Path 1. The operator adds `prompts.md` to the main agent or compression-agent prompt as instructed by the project documentation. 2. An attacker supplies conversation content designed to be interpreted as valuable t ...[truncated 847 chars]- Remediation
View remediation