T01 · Skill Instruction Hijacking
Error
- Location
scripts/generate_edl.py:135- Finding
Untrusted Transcript Content Is Embedded Directly into Agent Instructions
- Content
View full analysis
str: """Convert transcript JSON to compact text for the LLM prompt.""" lines = [] lines.append(f"Source: {transcript.get('source', 'unknown')}") lines.append(f"Duration: {transcript.get('duration', 0):.1f}s") lines.append(f"Language: {transcript.get('language', 'unknown')}") lines.append(f"Total phrases: {len(transcript.get('phrases', []))}") lines.append("") for phrase in transcript.get("phrases", []): start = phrase["start"] end = phrase["end"] speaker = phrase.get("speaker", "S0") text = phrase.get("text", "") conf = phrase.get("confidence", 0) lines.append(f"[{start:07.2f}-{end:07.2f}] {speaker} (conf:{conf:.2f}) {text}") return "\n".join(lines) def build_prompt(strategy_name: str, transcript_text: str, params: dict, strategies_yaml: dict) -> str: """Build the prompt sent to the LLM.""" if strategy_name in STRATEGY_PROMPTS: template = STRATEGY_PROMPTS[strategy_name] else: template = """You are a professional video editor. Analyze the following transcript according to the editing request and generate an EDL. Editing request: {custom_prompt} Transcript: {transcript_text} Return an EDL in JSON format.""" yaml_params = {} raw_strategies = strategies_yaml.get("strategies", {}) if strategy_name in raw_strategies: yaml_params = raw_strategies[strategy_name].get("parameters", {}) merged = {**yaml_params, **params} prompt = template.format( transcript_text=transcript_text, **merged, custom_prompt=params.get("custom_prompt", "No special requirements"), ) return prompt ``` ### Technical Analysis Spe ...[truncated 2514 chars]- Remediation
View remediation