T01 · Skill Instruction Hijacking
Error
- Location
utils/analyzer_controller.sh:185- Finding
Untrusted Review Content Is Embedded Directly into Agent Prompts
- Content
View full analysis
"$prompt_file" ``` The receiving prompt contains the following direct substitution point: ```text # Input Data {reviews_json} ``` ### Technical Analysis Review content is attacker-controlled or otherwise untrusted data. The controller serializes this content and substitutes it directly into an instruction prompt without a trust-boundary marker, escaping strategy, or an explicit instruction that text inside reviews must never be treated as agent instructions. JSON serialization protects the shell and JSON structure, but it does not protect the language-model instruction boundary. A review can contain text such as instructions to ignore the tagging task, reveal other context, produce falsified output, or invoke available tools. The Skill grants the hosting agent `Bash`, `Read`, `Write`, and `Edit` capabilities, so successful instruction confusion may have consequences beyond inaccurate classification if the host executes model-generated directions. The scripts shown prepare prompt files rather than invoking the model directly. Exploitation therefore depends on the documented main Skill workflow subsequently submitting those prompts to an agent. ### Attack Path 1. An attacker publishes or supplies a product review containing adversarial instructions. 2. The review is imported into the input CSV. 3. `csv_reader.sh` extracts the review ...[truncated 988 chars]- Remediation
View remediation