T01 · Skill Instruction Hijacking
- Location
scripts/analyzer.py:305- Finding
Untrusted Transcript Content Embedded Directly into LLM Instructions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyzer.py, lines 305-318
Vulnerability Type: Indirect prompt injection through untrusted transcript content
Risk Level: MediumComplete Code Snippet
python def generate_llm_prompt(self, text: str) -> str: """生成供 LLM 深度分析的提示词 当 agent 需要更高质量的分析时，可以将此提示词和文本一起发给 LLM """ char_count = len(text) est_minutes = round(char_count / 250, 1) return f"""请对以下转录文本进行深度分析（约 {char_count} 字，估计 {est_minutes} 分钟内容）： 1. **语义分段**：按主题/话题将文本分成若干段落，每段加上小标题 2. **核心要点**：提取 3-7 个核心观点或关键信息 3. **内容总结**：用 100-200 字概括全文核心内容 4. **口语化处理**：将口语表达转为书面语，保留所有要点，不做摘要压缩 转录文本： --- {text[:500]}{'...(已截断，完整文本请直接传入)' if len(text) > 500 else ''} ---"""Technical Analysis
generate_llm_prompt()directly interpolates attacker-controlled transcript content into an instruction intended for an LLM. The visual delimiter surrounding the transcript does not create an enforceable trust boundary. The generated prompt also contains no explicit instruction requiring the model to treat transcript content solely as untrusted data and to ignore commands found inside it.An attacker can place instruction-like content in a transcript, such as requests to disregard the analysis task, disclose context, generate deceptive output, or invoke available tools. If the returned
llm_promptis submitted to a tool-enabled agent, the model may interpret the embedded content as executable instructions rather than text to analyze.The function only embeds the first 500 characters, but this does not prevent exploitation because an attacker can place the malicious instruction at the beginning of the transcript.
Attack Path
- An attacker controls or influences a transcript supplied to the analyzer.
- The attacker places adversarial LLM instructions within the first 500 characters.
- The application calls
DouyinAnalyzer.analyze()or `generate_llm_prom ...[truncated 937 chars]
- Remediation
View remediation
Remediation Suggestions
- Pass transcript content through a separate structured input or data field rather than concatenating it with trusted instructions.
- Add an explicit security instruction stating that the transcript is untrusted data and that any commands, policies, or tool requests contained within it must not be followed.
- Use clear randomized or structured boundaries where supported, while recognizing that delimiters alone do not prevent prompt injection.
- Run transcript analysis with tools disabled unless tool access is strictly necessary.
- Apply least privilege to any downstream agent and require confirmation or policy validation before consequential tool operations.
- Validate model output against an expected schema and reject responses that contain unexpected commands, tool requests, or unrelated content.
- Add adversarial tests containing prompt-injection instructions at the beginning and throughout transcripts.