T01 · Skill Instruction Hijacking
- Location
github-trending.py:10- Finding
Untrusted GitHub Content Can Influence Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
github-trending.py:10-30; related processing instructions inSKILL.md:25-29
Vulnerability Type: Indirect prompt injection through untrusted web content
Risk Level: MediumComplete Code Snippet:
python url = "https://github.com/trending?since=daily" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" } try: response = requests.get(url, headers=headers) response.raise_for_status() soup = BeautifulSoup(response.text, 'html.parser') articles = soup.find_all('article', class_='Box-row') print("🔥 GitHub 今日趋势榜 Top 5:\n" + "-"*30) for i, article in enumerate(articles[:10], 1): # 获取项目名称 title_tag = article.find('h2', class_='h3 lh-condensed') title = title_tag.text.strip().replace('\n', '').replace(' ', '') if title_tag else "未知项目" # 💡 这里是修改的地方：直接抓取 p 标签 desc_tag = article.find('p') # 清洗一下文本，有时候简介里会有奇怪的换行 desc = desc_tag.text.strip().replace('\n', ' ') if desc_tag else "作者很懒，暂无简介" print(f"{i}. 项目: {title}\n 简介: {desc}\n")The relevant agent instruction in
SKILL.mdis:markdown 将输出保存，用于后续翻译。 ### Step 2 - 翻译项目信息 将脚本输出的每个项目名称和简介翻译成准确且符合中文语言习惯的中文。Technical Analysis
The script retrieves repository names and descriptions from the public GitHub Trending page and prints those fields for subsequent processing by the AI agent. Repository descriptions are controlled by third-party GitHub users and therefore constitute untrusted input.
The only transformation applied to descriptions is trimming whitespace and replacing newline characters. It does not identify, neutralize, delimit, or reject instruction-like text. The skill then directs the agent to consume and translate the output without explicitly requiring it to treat all scraped fields ...[truncated 1603 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit instruction to
SKILL.mdstating that repository names and descriptions are untrusted data and that commands, requests, URLs, or policy-like text contained in those fields must never be followed. - Emit structured output, such as JSON, with fixed fields for
repository_nameanddescription, rather than presenting remote content as undifferentiated prose. - Wrap every remote value in clear data delimiters and instruct the agent to translate only text inside the designated fields.
- Enforce conservative length and character limits before placing descriptions into agent context.
- Optionally flag or reject descriptions containing common prompt-injection patterns, while recognizing that filtering alone is not a complete defense.
- Ensure the agent has only the minimum tools and permissions required for translation so that successful instruction manipulation cannot trigger privileged side effects.
- Add tests using adversarial descriptions to verify that embedded instructions are translated or ignored as data rather than executed as agent directives.
- Add an explicit instruction to