T01 · Skill Instruction Hijacking
Warning
- Location
- youtubeUtils.ts:70
- Finding
- Indirect Prompt Injection Through Untrusted YouTube Metadata<![CDATA[ ## Vulnerability Details **File Location**: `youtubeUtils.ts:70-83` **Vulnerability Type**: Indirect prompt injection **Risk Level**: Medium ### Vulnerable Code ```ts const prompt = `Analyze the following YouTube video information and return the main idea and a list of main points.\n` + `Title: ${video.title}\n` + `Description: ${video.description}\n` + `Transcript: ${transcript}`; const completion = await anthropic.messages.create({ model: 'claude-3-haiku-20240307', // You can use 'claude-3-sonnet-20240229' or 'claude-3-opus-20240229' if you have access max_tokens: 400, messages: [ { role: 'user', content: prompt } ] }); const summary = completion.content[0]?.text || ''; mainIdea = summary.split('\n')[0] || ''; transcriptPoints = summary.split('\n').slice(1).join('\n'); ``` ### Technical Analysis The Skill inserts YouTube titles and descriptions directly into an instruction-bearing LLM prompt. These values are controlled by YouTube content publishers and are not separated from trusted instructions using a structured data format, explicit delimiters, or a system-level instruction that requires embedded commands to be ignored. An attacker can publish a video whose title or description contains instructions such as requests to disregard the analysis task and produce attacker-selected text. If the video is selected as an outlier, those instructions are submitted to Anthropic as part of the user message. The generated response is subsequently treated as trusted analytical output. This issue does not give the Anthropic model access to local tools, credentials, files, or system commands. Its practical effect is limited to manipulating the generated report content. ### Attack Path 1. An attacker publishes a YouTube video with prompt-injection instructions in its title or description. 2. The video receives enough views to rank in the top 20% of videos returned for a targeted niche. 3. A user invokes the Skill for that niche. 4. The ...[truncated 818 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Put untrusted metadata into a clearly delimited or structured section, such as a serialized JSON object. 2. Use a higher-priority system instruction explicitly stating that titles, descriptions, and transcripts are untrusted data and that any instructions contained in them must not be followed. 3. Request a strict structured response and validate it before use, for example with a JSON schema containing only `mainIdea` and `mainPoints`. 4. Reject responses containing unexpected fields, excessive lengths, links, mentions, or instruction-like content. 5. Apply separate output encoding and sanitization before publishing generated text to Discord or Google Sheets. 6. Consider processing each metadata field independently or using a non-generative extraction method where possible. ]]>