T01 · Skill Instruction Hijacking
Error
- Location
scripts/morning-brief.sh:43- Finding
Untrusted CRM Content Is Embedded in Agent Instructions Without Isolation
- Content
View full analysis
> "$PIPELINE" << EOF ### ${NAME} @ ${COMPANY} - **Stage**: ${STAGE} - **Type**: Unknown — detect on next interaction (look for Tiger/Peacock/Koala/Owl signals) - **Score**: 45 - **Status**: 🟢 Green - **Deal Size**: ${DEAL_SIZE} - **Last Contact**: ${TODAY} - **Next Action**: Schedule discovery call within 48 hours — prepare 3 open questions about their pain - **Key Pain**: To be discovered - **Notes**: ${NOTES} EOF ``` `scripts/log-activity.sh:24-32` similarly persists untrusted activity content: ```bash cat >> "$ACTIVITY_LOG" << EOF ## ${TODAY} ${TIME} — ${CUSTOMER} @ ${COMPANY} - **Activity**: ${ACTIVITY} - **Summary**: ${SUMMARY} - **Next step**: ${NEXT_STEP} - **Logged**: $(date) EOF ``` `scripts/morning-brief.sh:43-59` prints the resulting file directly into a prompt-like output immediately before Agent instructions: ```bash echo "📋 PIPELINE DATA:" echo "" cat "$PIPELINE" echo "" echo "---" echo "" echo "💡 AGENT INSTRUCTIONS:" echo "Based on the pipeline above, please:" echo "1. Identify all leads with Last Contact > 7 days → flag 🔴 Red" echo "2. Identify leads in 'closing' or 'negotiation' stage → top priority" echo "3. For each priority lead, check their Type (Tiger/Peacock/Koala/Owl)" echo " and suggest the right approach script" echo "4. List top 3-5 actions for today, ordered by urgency score" echo "5. Identify which leads to SEED today (new outreach)" echo "6. End with: total active leads, deals at risk, and one this-week close target" echo "" echo "Format output as t ...[truncated 3398 chars]- Remediation
View remediation