T01 · Skill Instruction Hijacking
Warning
- Location
scripts/propose.py:286- Finding
Untrusted Content Can Influence an Auto-Executable Skill Modification
- Content
View full analysis
", ' '"action": "append_markdown_section" or "replace_markdown_section", ' '"content_lines": ["line1", "line2", ...], ' '"rationale": "why this fixes the failures"}}' ) try: result = subprocess.run( ["claude", "-p", "--output-format", "json"], input=prompt, capture_output=True, text=True, timeout=120, ) if result.returncode != 0: return None # Parse claude output try: claude_out = _json.loads(result.stdout) text = claude_out.get("result", result.stdout) except (_json.JSONDecodeError, TypeError): text = result.stdout # Extract JSON from response (may be wrapped in markdown) text = text.strip() # Find the first { and last } to extract JSON robustly first_brace = text.find("{") last_brace = text.rfind("}") if first_brace >= 0 and last_brace > first_brace: text = text[first_brace:last_brace + 1] parsed = _json.loads(text) return { "id": "cand-01-eval-fix", "title": f"Fix SKILL.md based on {len(failed_tasks)} evaluator failure(s)", "target_path": str(skill_md.resolve()), ...[truncated 3894 chars]- Remediation
View remediation