T01 · Skill Instruction Hijacking
Error
- Location
scripts/heartbeat-coordinator.js:108- Finding
Untrusted Task Content Is Embedded Directly into Agent Prompts
- Content
View full analysis
`${i + 1}. ${s}`).join('\n')} ## Previous Result ${lastResult.summary || '(First iteration)'} `; ``` The same pattern is used when constructing the Executor prompt: ```js function buildExecutePrompt(task) { const instructions = task.review?.next_instructions; if (!instructions) { return `Task ${task.task_id} is reviewed but missing next_instructions.`; } const step = instructions.step || {}; const criteria = instructions.acceptance_criteria || []; return `You are an Executor for the auto-evolution system. ## Task - **ID:** ${task.task_id} - **Goal:** ${task.goal} - **Current Step:** ${instructions.current_step} / ${instructions.total_steps} ## Subtask **${step.action || instructions.summary}** ${step.detail || ''} ## Acceptance Criteria ${criteria.map((c, i) => `${i + 1}. ${c}`).join('\n')} ``` Execution results and review instructions are also inserted into the Auditor prompt: ```js function buildAuditPrompt(task) { const instructions = task.review?.next_instructions; const result = task.result || {}; return `You are an Auditor for the auto-evolution system. ## Task - * ...[truncated 3152 chars]- Remediation
View remediation