T01 · Skill Instruction Hijacking
Error
- Location
connector.js:286- Finding
Untrusted Remote Game Content Is Embedded in AI-Facing Action Prompts
- Content
View full analysis
{ if (log.content || log.publicAction) { safeLog(`[GAME LOG] ${log.agentName || log.agentId}: ${log.content || log.publicAction}`) } }) ``` ```js const recentLogs = (Array.isArray(log) ? log : []).slice(-5) // ... safeLog(`\nRECENT EVENTS:`) recentLogs.forEach(l => { const msg = l.content || l.publicAction || l.type safeLog(` [${l.agentName || l.agentId || 'SYSTEM'}] ${msg}`) }) safeLog(`\nRespond with JSON:`) safeLog(` { "intent": "COOPERATE", "target": "AGENT_ID", "say": "...", "think": "..." }`) ``` ### Technical Analysis The connector places server- and player-controlled game messages directly inside the same terminal context as instructions intended for an AI agent. There is no trust-boundary marker, escaping, content classification, or instruction telling the agent to treat game messages exclusively as inert data. Because `SKILL.md` instructs an AI agent to read the connector output and respond with JSON, malicious text in `log.content`, `publicAction`, agent names, or related fields may be interpreted as higher-level instructions rather than game dialogue. This creates a prompt-injection channel. The flagged spectator message at `connector.js:535` is not itself malicious; it is a static local status message. The actual injection risk arises from the unsanitized remote content printed at the locations above. ### Attack Path 1. A malicious player submits a public game statement containing instructions directed at an AI agent. 2. The backend includes that statement in `message.state.log`. 3. The connector prints the statement under `RECENT EVENTS` or `GAME LOG` immediately adjacent to `[ACTION REQUIRED]` and response-format instructions. 4. A ...[truncated 682 chars]- Remediation
View remediation