T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:94- Finding
Untrusted Remote Chat Content Is Treated as Authoritative Agent Instructions
- Content
View full analysis
.ext`. Infer filename from surrounding text. ### 6. Detect code fragments When DeepSeek runs out of space, it outputs fragments labeled with: - `关键代码片段` - `精简` / `实现要点` - `由于长度限制` - `参考 XXX 的结构自行实现` These are NOT complete files. Write them to `FRAGMENTS_TODO.md` with the target file they belong to, rather than as standalone `.swift` files. ### 7. Write files - Respect the project tree from step 4. - Deduplicate: if the same path appeared in multiple turns, write only the last version. - Complete files → write to their path. Fragments → write to `FRAGMENTS_TODO.md`. - Follow the same code style, naming, and patterns as existing code in the chat. - If the chat references a local repo, write files there. Otherwise create under a new project dir. ``` ```markdown Then proceed to implement the next unfinished task. ## Notes - The DeepSeek chat is the source of truth — don't override chat decisions with personal preferences. - Cache extracted content per URL to avoid re-reading within the same session. - Append new work to `memory/YYYY-MM-DD.md` so context persists across sessions. ``` ### Technical Analysis The skill retrieves content from a user-supplied DeepSeek page and directs the agent to treat that content as the “source of truth.” It also instructs the agent to follow the content's project structure, write its files, and proceed with implementation. A remote chat page is an untrusted input channel. Its author can include natural-language instructions, fabricated project requirements, deceptive file headers, or content designed to override the user's actual request. The workflow does not establish a boundary bet ...[truncated 1822 chars]- Remediation
View remediation