T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:61- Finding
Untrusted Markdown Reports Can Hijack the Autonomous Agent Workflow
- Content
View full analysis
deduplicate -> decide page types -> generate pages (max 3) -> register navigation + sitemap -> SEO audit -> git commit and push -> update processed.json." } } ``` ``` The corresponding processing template directs the Agent to discover and parse all new Markdown reports: ```markdown ### Phase 0: Discover New Reports 1. Read processed.json for already-handled reports 2. Scan report directory for new .md files 3. If none found, stop ### Phase 1: Parse Report Extract from each new report: - Top keywords with priority - Search intent (transactional / informational) - Competition score - Recommended page type and URL slug ``` ### Technical Analysis New Markdown files in the configured report directory automatically trigger an Agent task. The report is treated as Agent-readable content, but the workflow does not establish a trust boundary between report data and executable natural-language instructions. There are no requirements to: - Treat report text strictly as untrusted data. - Ignore commands or behavioral instructions embedded in a report. - Parse reports through a deterministic schema. - Validate extracted fields against an allowlist. - Restrict the Agent to approved output paths. - Require human confirmation before repository modifications or Git operations. Consequently, a contributor or compromised ...[truncated 2075 chars]- Remediation
View remediation