T01 · Skill Instruction Hijacking
Warning
- Location
workflows/anti-fraud-drill.yaml:3- Finding
Unvalidated Workflow Inputs Are Interpolated into Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
workflows/anti-fraud-drill.yaml:3-16, 21-38
Vulnerability Type: Prompt injection through direct template interpolation
Risk Level: MediumVulnerable Code
The following is an English rendering of the relevant YAML content; the configuration structure and interpolation expressions are preserved:
yaml inputs: - name: scam_type required: true description: "Scam type to simulate; expected to match a knowledge-base title" - name: user_level required: false default: "general" description: "Audience level: beginner or general" - name: target_group required: false default: "general audience" description: "Audience profile used by the mentor" steps: - id: fraudster_attack role: "security/fraudster" task: >- Act as a fraudster and generate a realistic inducement script for "{{scam_type}}". Target a {{user_level}} audience. output: attack_script - id: user_response role: "user" task: >- Respond to the preceding scam script as a {{target_group}} user. output: user_reply - id: fraudster_pressure role: "security/fraudster" task: >- Act as a fraudster and generate targeted secondary pressure after seeing the user's response. output: pressure_script - id: mentor_review role: "security/mentor" task: >- Review the complete exercise for the {{target_group}} audience. output: mentor_feedback - id: evaluator_score role: "security/evaluator" task: >- Score the user's response based on the preceding exercise. output: evaluation_report - id: drill_summary role: "security/mentor" task: >- Compare the exercise with the "{{scam_type}}" knowledge-base entry and summarize it for the {{target_group}} audience. output: drill_summaryTech
...[truncated 2162 chars]
- Remediation
View remediation
Remediation Suggestions
- Define enforceable enums for
scam_type,user_level, andtarget_group; reject every value not exactly present in the approved lists. - Apply strict length limits and reject control characters, multiline values, markup, template syntax, and instruction-like payloads.
- Pass inputs as structured data fields rather than concatenating them into natural-language instructions.
- If interpolation is unavoidable, place values inside explicit data delimiters and instruct each role that delimited content is untrusted data and must never be followed as instructions.
- Validate generated output before forwarding it to another role, including checks for role-switching language, embedded instructions, requests for real information, and unsafe operational guidance.
- Keep immutable safety constraints separate from user-controlled templates and ensure the workflow runner gives those constraints higher priority.
- Add adversarial tests covering multiline injection, delimiter breaking, role reassignment, scoring manipulation, and attempts to override the simulation-only boundary.
- Define enforceable enums for