T01 · Skill Instruction Hijacking
Error
- Location
index.ts:71- Finding
Untrusted Remote Collaboration Files Are Injected into the System Prompt
- Content
View full analysis
{ const channelId = ctx.channelId; if (!channelId) return; const sessionKey = ctx.sessionKey || ""; logger.info(`[context] prompt-hook: sessionKey=${sessionKey}, channelId=${channelId}`); const cg = extractChannelGroup(sessionKey, channelId); if (!cg) return; try { // Look up space const lookupRes = await fetch( `${serverUrl}/api/spaces/lookup?channel=${encodeURIComponent(cg.channel)}&groupId=${encodeURIComponent(cg.groupId)}`, { signal: AbortSignal.timeout(3000) } ); if (!lookupRes.ok) return; const lookupData = await lookupRes.json() as any; const spaceId = lookupData.space?.id; if (!spaceId) return; // Fetch protocol const protocolRes = await fetch( `${serverUrl}/api/spaces/${spaceId}/protocol`, { signal: AbortSignal.timeout(3000) } ); if (!protocolRes.ok) return; const protocol = await protocolRes.json() as any; const injection = buildPromptInjection(protocol, spaceId); logger.info(`[context] prompt-hook: injecting protocol for space ${spaceId} (${injection.length} chars)`); return { appendSystemContext: injection }; } catch (err: any) { logger.info(`[context] prompt-hook: error — ${err.message}`); return; } }); ``` The remote response is incorporated without sanitization: ```ts export function buildPromptInjection(protocol: { space: string; team: string; task: string }, spaceId: string): string { const sections: string[] = []; sections.push(`## Context Space — 共享协作协议`); sections.push(``); sections.push(`你正在参与一个共享的 Context Space (ID: ${spaceId})。`); sections.push(`**所有工作产出必须写到这个共享空间，不要写到本地 workspace。**`); sections.push(`**分享文件时，使用 Context URL: ${CTX_BASE}/ctx/${spac ...[truncated 3375 chars]- Remediation
View remediation