T01 · Skill Instruction Hijacking
Error
- Location
scripts/cron_builder.py:69- Finding
Persistent Agent Prompt Injection Through Unvalidated Route Values
- Content
View full analysis
List[str]: parts = [p.strip() for p in (s or "").split(",") if p.strip()] if not parts: raise ValueError("routes required") return parts def build_prompt(city: str, node: str, routes: List[str]) -> str: routes_csv = ",".join(routes) # The agent will run the deterministic script and then output a clean summary. return ( "You are running a scheduled TAGO bus arrival alert.\n" "- Do not reveal any secrets.\n" "- Query TAGO arrivals using the helper script and format a short message.\n\n" "Steps:\n" f"1) Run: python3 korea-metropolitan-bus-alerts/scripts/tago_bus_alert.py arrivals --city {city} --node {node} --routes {routes_csv}\n" "2) Parse the JSON and produce a human-friendly summary (Korean).\n" "3) Output ONLY the final message text (no code blocks).\n\n" "Format example:\n" "[버스 알림]\n" "- 535: 3분(2정거장 전) / 다음 12분\n" "- 730: 5분 / 다음 18분\n" ) ``` The generated prompt is registered as a recurring Agent task: ```python routes = parse_routes(input("Routes (comma-separated, e.g. 535,730): ").strip()) ... job = { "name": name, "schedule": {"kind": "cron", "cron": spec.to_cron(), "tz": spec.tz}, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": build_prompt(city, node, routes), "deliver": True, "bestEffortDeliver": True, "channel": channel, "to": to, }, } ... cmd = [ exe, "cron", "add", "--name", name, "--cron", spec.to_cron(), "--tz", spec.tz, "--session", "isolated", "--mes ...[truncated 2480 chars]- Remediation
View remediation
List[str]: routes = [part.strip() for part in value.split(",") if part.strip()] if not routes: raise ValueError("routes required") if len(routes) > 20: raise ValueError("too many routes") for route in routes: if not ROUTE_RE.fullmatch(route): raise ValueError(f"invalid route identifier: {route!r}") return routes ``` 2. Apply similarly strict allowlists to `city` and `node`, including length limits and rejection of whitespace and control characters. 3. Reject newlines, carriage returns, null bytes, leading option markers, and shell metacharacters in all values embedded in Agent instructions. 4. Avoid constructing executable commands inside natural-language prompts. Store structured arguments and invoke the deterministic helper through a fixed non-shell tool interface. 5. If an Agent prompt must contain external values, serialize them as clearly delimited JSON data and explicitly state that the data must never be interpreted as instructions. 6. Add tests covering newline injection, command separators, leading `--` values, oversized input, and embedded instruction text. ]]>