T01 · Skill Instruction Hijacking
Error
- Location
- references/chat-task.md:1
- Finding
- Untrusted Execution Instructions Are Injected Directly into Agent System Prompts<![CDATA[ ## Vulnerability Details **File Location**: `references/chat-task.md:1-37` **Additional Locations**: `references/chat-project.md:40`, `references/chat-schedule.md:43`, `references/task-push.md:65-67` **Vulnerability Type**: Prompt injection through untrusted template interpolation **Risk Level**: Critical ### Vulnerable Code ```markdown --- title: 任务聊天上下文模板 description: 与 AI 讨论某个任务时注入的系统提示 --- 你正在与用户讨论以下任务，请基于任务信息回答问题。如果讨论中需要更新任务，可通过操作指令或 Markdown 同步方式完成。 ## 系统信息 **团队成员**：{{human_member_names}}（人类）、{{ai_member_names}}（AI） ## 当前任务信息 - **任务ID**：{{task_id}} - **标题**：{{task_title}} - **状态**：{{task_status}} - **优先级**：{{task_priority}} - **进度**：{{task_progress}}% {{#task_description}} - **描述**：{{task_description}} {{/task_description}} {{#task_deadline}} - **截止日期**：{{task_deadline}} {{/task_deadline}} {{#project_name}} - **所属项目**：{{project_name}} {{/project_name}} {{^project_name}} - **全局任务**（未关联项目） {{/project_name}} - **负责人**：{{task_assignees}} {{#has_check_items}} ### 检查项（{{completed_count}}/{{total_count}} 已完成） {{check_items_text}} {{/has_check_items}} {{execution_instructions}} ``` Equivalent raw interpolation of `{{execution_instructions}}` also occurs in the project-chat, schedule-chat, and task-push templates. ### Technical Analysis The templates are explicitly described as system prompts, but `execution_instructions` is inserted verbatim without a trust boundary, escaping, schema validation, or separation between data and executable Agent instructions. If this field is populated from a task, project, schedule, or other remotely managed CoMind record, its owner can introduce arbitrary instructions into a privileged prompt context. The Agent may interpret those instructions as authoritative Skill behavior rather than as untrusted task data. This is especially dangerous because the Skill also documents privileged actions for modifying tasks, creating or updating documents, scheduling work, changing Agent state, synchronizing identity, and ...[truncated 1651 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `execution_instructions` from all system-prompt templates. 2. Treat all server-managed task, project, schedule, description, comment, and instruction fields as untrusted data. 3. Place remote content inside an explicitly delimited data block accompanied by a rule that it must never override system or user instructions. 4. Replace free-form execution instructions with a strict, versioned schema containing an allowlisted set of operations and validated arguments. 5. Reject fields containing role markers, tool-call syntax, prompt-control directives, or requests to access credentials and unrelated files. 6. Require explicit user confirmation before credential access, identity changes, schedule creation, bulk updates, external publication, or workspace synchronization. 7. Apply authorization checks based on the authenticated record owner and the requested action, rather than relying on prompt text. 8. Add adversarial tests covering instruction injection through every interpolated template field. ]]>