T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:42- Finding
Untrusted Web Content Is Passed Directly into the Agent Context
- Content
View full analysis
]*>([\s\S]*?)', '', html_content) text = re.sub(r']*>([\s\S]*?)', '', text) text = re.sub(r'<[^>]+>', ' ', text) text = re.sub(r'\s+', ' ', text).strip() return text[:2500] # 每篇详情页限制前 2500 字，防止大模型爆 Token ``` The extracted content is returned to the Agent without a trust boundary: ```python final_payload.append({ "source": src["title"], "title": item["title"], "content": pure_text }) ``` The storage-enabled implementation follows the same pattern: ```python def extract_pure_text(html_content): text = re.sub(r']*>([\s\S]*?)', '', html_content) text = re.sub(r']*>([\s\S]*?)', '', text) text = re.sub(r'<[^>]+>', ' ', text) text = re.sub(r'\s+', ' ', text).strip() return text[:2500] ``` ```python final_payload.append({ "source": src["title"], "title": item["title"], "content": pure_text, "url": item["url"] }) ``` ```python result = { "status": "success", "date": today, "article_count": len(articles), "articles": articles } print(json.dumps(result, ensure_ascii=False)) ``` ### Technical Analysis Article titles and bodies are controlled by external publishers or by anyone capable of compromising a source page. Removing scripts, styles, and HTML tags ...[truncated 2175 chars]- Remediation
View remediation