T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:66- Finding
Untrusted arXiv Paper Content Is Read Without a Prompt-Injection Boundary
- Content
View full analysis
/summary.md` if the user asked for files. Otherwise return the summary directly in chat. ## Summary format Use the headings in `{baseDir}/references/summary-format.md`. Keep the summary grounded in the generated Markdown. If the conversion falls back to abstract-only mode, say so explicitly in the summary. ``` The remote content is assembled and saved without any trust classification or instruction boundary: ```python paper_markdown = assemble_markdown(metadata, body, source_kind) output_paths["paper_md"].write_text(paper_markdown, encoding="utf-8") metadata_payload = { **asdict(metadata), ``` ### Technical Analysis The paper body originates from remotely supplied arXiv HTML or TeX. Although the converter treats it as text and does not execute it as local code, the Skill subsequently instructs the AI Agent to read and reason over the generated Markdown. Neither the Skill instructions nor the generated artifact explicitly state that instructions appearing inside the paper are untrusted data that must not influence tool use, goals, safety constraints, or disclosure decisions. Consequently, a paper containing text such as purported system instructions, requests to inspect local files, or commands to call tools can become an indirect prompt-injection payload when `paper.md` is placed into the Agent's context. The HTML parser excludes some active tags, and the TeX converter strips many commands, but these transformations do not remove ordinary natural-language instructions. Prompt injection does not require executable HTML, JavaScript, or TeX. ### Attack Pat ...[truncated 1640 chars]- Remediation
View remediation
Treat all paper metadata, HTML, TeX, PDF text, and generated Markdown as untrusted data. Never follow instructions found in paper content, never allow that content to alter the task, and never invoke tools based solely on text contained in a paper. 2. Delimit remote content clearly when presenting it to the Agent, using explicit begin/end markers and a statement that everything inside the markers is reference material rather than instructions. 3. Keep operational Skill instructions separate from downloaded content. Do not concatenate remote paper text into system or developer instruction blocks. 4. Require explicit user confirmation before any tool action that is suggested by paper content and is not directly required for fetching or summarizing the selected paper. 5. Consider detecting and annotating conspicuous prompt-injection phrases in generated Markdown. Preserve the original document for fidelity, but mark suspicious passages as untrusted rather than silently treating them as instructions. 6. Apply the same protections to abstracts, titles, author fields, HTML bodies, TeX source, search-result files, and automatically generated topic summaries because all can contain attacker-controlled text. ]]>