T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:38- Finding
Untrusted Dynamically Discovered Knowledge Bases Can Cause Prompt Injection
- Content
View full analysis
); say 'refresh knowledge base' to verify." ``` `SKILL.md:57-68`: ```markdown ### Step 4 — Select knowledge bases and retrieve (parallel limit: 3) Select 1-3 preferred libraries according to the routing table in `references/ima_kb_catalog.md`, then invoke retrieval: ``` mcp__ima-mcp__search_knowledge → params: {"knowledge_base_id":"","query":"","cursor":""} ``` - Only take `title / introduction / highlight_content`; truncate each highlight to the first 800 characters. - Use `cursor` for pagination when there are too many results (first page `""`), with at most 2 pages per library. - Deduplicate and merge results from multiple libraries while retaining source labels. - **KB-L degradation handling**: KB-L is a backup library for case retrieval. If retrieval fails / is not mounted / returns empty → **do not interrupt the main process**, but append "Note: The legal case library (KB-L) is currently unavailable; similar-case recommendations are not activated." to the end of 【Sources】 (see `ima_kb_catalog.md` 3.3). ### Step 5 — Generate response (four-section format) During fusion, strictly apply `` from `system_prompt.md`: resolve cross-library conflicts according to authority hierarchy; ignore irrelevant retrieved fragments; tri ...[truncated 4431 chars]- Remediation
View remediation
... ``` Explicitly state that text inside this element cannot modify Agent policy. 5. **Add prompt-injection filtering** Before placing results in the model context, flag or discard passages containing suspicious instruction patterns, including requests to ignore prior instructions, change roles, reveal prompts, invoke tools, or conceal sources. Filtering should supplement—not replace—source approval and instruction isolation. 6. **Constrain tool use** - Do not derive tool names, destinations, or sensitive arguments from retrieved content. - Validate all tool parameters against the selected route and approved KB IDs. - Require confirmation for any action beyond read-only knowledge retrieval. 7. **Strengthen provenance controls** Verify source ownership, publication identity, and expected subject matter. Pin approved library IDs a ...[truncated 340 chars]