T01 · Skill Instruction Hijacking
Error
- Location
scripts/codex_backend.py:137- Finding
Prompt Injection into a Full-Auto Codex Sub-Agent
- Content
View full analysis
10KB；若失败请报错退出非零。\n" f"- 不要向我解释或改写 prompt，直接出图。\n\n" f"图片 prompt：\n" f"-----BEGIN PROMPT-----\n" f"{prompt}\n" f"-----END PROMPT-----\n" ) ``` ```python instruction = self._build_instruction(prompt, output_path, reference_image_path) argv = shlex.split(self.codex_cmd) + [instruction] print(f"🔗 [scene {scene_index}] dispatching to codex ({len(instruction)} chars)") try: result = subprocess.run( argv, capture_output=True, text=True, timeout=self.timeout, check=False, ) ``` ### Technical Analysis The slide image prompt is incorporated verbatim into a natural-language instruction passed to a separate `codex exec --full-auto` process. The `BEGIN PROMPT` and `END PROMPT` markers are textual conventions rather than an enforceable data boundary. An attacker who controls slide content, imported presentation text, or another source used to construct `image_prompt` can insert instructions that tell the spawned Codex agent to disregard the surrounding image-generation request. Because the subprocess is a general autonomous agent rather than a narrowly scoped image API, it may have filesystem and tool capabilities beyond those required to create an image. The use of an argument array prevents operating-system shell injection, but it does not prevent semantic prompt injection against the Codex agent. ### Attack Path 1. An attacker supplies presentation content that conta ...[truncated 966 chars]- Remediation
View remediation