T01 · Skill Instruction Hijacking
Error
- Location
handler.mjs:109- Finding
Privileged System-Prompt Injection Alters Agent Behavior
- Content
View full analysis
m.role === 'system'); const insertIdx = lastSystemIdx >= 0 ? msgs.length - 1 - lastSystemIdx + 1 : 0; msgs.splice(insertIdx, 0, { role: 'system', content: guardPrompt, name: 'rl-runtime-guard', }); } else if (typeof requestData.systemPrompt === 'string') { requestData.systemPrompt = guardPrompt + '\n\n' + requestData.systemPrompt; } ``` The injected `guardPrompt` is assembled by the prompt-builder functions at lines 109-152. Those prompts impose mandatory planning, response, tool-use, path, command-length, and stopping requirements. ### Technical Analysis The handler elevates Skill-controlled advisory text to the privileged system-instruction level. When `requestData.messages` is present, it inserts a new message with `role: 'system'`. For other supported request formats, it prepends the generated instructions to the existing system prompt or context. The injected prompts are not merely informational warnings. They contain mandatory workflow directives, prohibited behaviors, forced preliminary responses, tool-use restrictions, and stopping conditions. They also state that violations will cause tool calls to fail, although this handler implements no corresponding enforcement. Activation is based on broad heuristics, including message length, selected multi-step markers, similarity to earlier user messages, and path-like strings. Consequently, an ordinary user message can cause Skill-authored instructions to gain system-level priority without explicit per-request consent. The behavior is disclosed as prompt augmentation, and no hidden remote payload o ...[truncated 1776 chars]- Remediation
View remediation