T01 · Skill Instruction Hijacking
Error
- Location
references/投资协议要点库.md:863- Finding
Embedded Tool-Call Instruction Can Trigger Unauthorized File Creation
- Content
View full analysis
# Investment Agreement Reference ``` ### Technical Analysis A document presented as passive investment-agreement reference material contains an imperative instruction followed by serialized tool-call syntax for a `write_file` operation. This content is unrelated to the reference document's declared purpose and crosses the security boundary between data consumed by the agent and instructions controlling agent behavior. The primary `SKILL.md` directs the agent to consult this reference. If an agent does not strictly distinguish trusted Skill instructions from untrusted reference content, it may interpret the embedded markup as an authorized request to invoke a file-writing tool. The file does not merely describe tool syntax in a security example; it directs the agent to create files and begins supplying attacker-controlled content. This behavior exceeds the minimum privileges required for investor due diligence. Producing research and risk-assessment reports does not require reference documents to initiate workspace modifications. ### Attack Path 1. A user invokes the investor due-diligence Skill for its declared purpose. 2. The agent follows the resource references in `SKILL.md` and reads `references/投资协议要点库.md`. 3. The agent reaches the imperative instruction at line 863 and the serialized `write_file` invocation at lines 864-866. 4. A vulnerable instruction-following agent treats the embedded reference content as an active tool request rather than ...[truncated 1109 chars]- Remediation
View remediation