T01 · Skill Instruction Hijacking
Error
- Location
scripts/merge-pr-context.py:120- Finding
Untrusted pull-request content is passed to the agent without prompt-injection isolation
- Content
View full analysis
"$_STDERR_TMP") || { echo "fetch-pr.sh: gh pr view failed: $(cat "$_STDERR_TMP")" >&2 exit 2 } # --------------------------------------------------------------------------- # Fetch PR diff (non-fatal if it fails — diff may be unavailable for closed PRs) # --------------------------------------------------------------------------- PR_DIFF="" PR_DIFF=$(gh pr diff "$PR" "${REPO_ARGS[@]}" 2>/dev/null) || PR_DIFF="" # --------------------------------------------------------------------------- # Build JSON safely via Python (shell values in env, never interpolated) # --------------------------------------------------------------------------- PR_JSON=$(PR_META="$PR_META_OUT" PR_DIFF="$PR_DIFF" python3 - <<'PY' ``` `scripts/fetch-pr.sh:106-120` places that content in the source blob without establishing a trust boundary: ```python result = { "source": "fetch-pr", "pr_number": data.get("number"), "repo": repo_slug, "url": url, "title": data.get("title", ""), "body": data.get("body") or "", "head_ref": data.get("headRefName", ""), "base_ref": data.get("baseRefName", ""), "head_sha": data.get("headRefOid", ""), "state": data.get("state", ""), "files_changed": len(data.get("files") or []), "additions": data.get("additions", 0), "dele ...[truncated 3300 chars]- Remediation
View remediation