T01 · Skill Instruction Hijacking
Warning
- Location
scripts/update_snapshot.py:86- Finding
Untrusted News Metadata Can Inject Instructions into the Agent Context
- Content
View full analysis
bytes: request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) with urllib.request.urlopen(request, timeout=timeout) as response: return response.read() ``` `scripts/fetch_news.py:202-218` stores remote metadata without filtering instruction-like content: ```python context_text = " ".join( part for part in [title, source, item.findtext("description") or "", query] if part ) items.append( NewsItem( title=title, source=source, published_at=published_at.isoformat() if published_at else "", age_hours=age_hours, link=link, query=query, provider=provider, tags=infer_tags(context_text), ) ) ``` `scripts/update_snapshot.py:86-101` places the remote fields directly into an Agent-readable Markdown document: ```python lines.extend(["", "## Recent Headlines"]) if items: for index, item in enumerate(items[:12], start=1): source = item.get("source") or item.get("provider") or "unknown" published_at = item.get("published_at") or "unknown_time" query = item.get("query") or "unknown_query" lines.extend( [ f"{index}. {item.get('title', '')}", f" - source: {source}", f" - published_at_utc: {published_at}", f" - que ...[truncated 3605 chars]- Remediation
View remediation