T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:101- Finding
Indirect Prompt Injection Through Untrusted Book Content
- Content
View full analysis
Translate the file `/chunk.md` to {TARGET_LANGUAGE} and write the result to `/output_chunk.md`. Follow the translation rules below. Output only the translated content — no commentary. Each sub-agent's task: 1. Read the source chunk file (e.g. `chunk0001.md`) 2. Translate the content following the translation rules below 3. Write the translated content to `output_chunk0001.md` 4. Write observations to `output_chunk0001.meta.json` matching the schema below. ``` ### Technical Analysis The source book is attacker-controllable content. After conversion, its text is placed in Markdown chunks and supplied directly to AI sub-agents. The Skill does not explicitly establish a trust boundary stating that instructions found inside a chunk are untrusted data and must never be followed. Because the Skill permits tools including `Read`, `Write`, `Edit`, and `Bash`, a successfully injected instruction could influence a sub-agent to perform operations beyond translation. The exact impact depends on whether the runtime restricts each sub-agent's tool permissions and accessible filesystem paths. Output-format instructions such as “output only the translated content” do not reliably prevent indirect prompt injection because they do not tell the model to treat instructions embedded in the source book as inert text. ### Attack Path 1. An attacker creates a PDF, DOCX, or EPUB containing text framed as instructions to an AI agent. 2. `scripts/convert.py` converts the document and copies the malicious instructions into a `chunkNNNN.md` file. 3. The main Skill launches a sub-agent and instructs it to read that chunk. 4. The malicious text asks the sub-agent to disregard the translation task, read other files, invoke tools, or write unauthorized content. 5. If the ...[truncated 738 chars]- Remediation
View remediation