T01 · Skill Instruction Hijacking
Warning
- Location
scripts/read_pdf.py:83- Finding
Untrusted PDF Content Is Exposed to the Agent Without Prompt-Injection Safeguards
- Content
View full analysis
0 else total full_text = "" for i in range(limit): text = doc[i].get_text() full_text += f"\n=== Page {i+1}/{total} ===\n{text}" if max_pages == 0 or max_pages >= total: full_text += f"\n[Truncated at page {limit}/{total}]" doc.close() return full_text ``` ```python print(f"Extracting text (max_pages={args.pages or 'all'})...") text = extract_text(pdf_path, args.pages) if args.output: with open(args.output, "w", encoding="utf-8") as f: f.write(text) print(f"Text written to: {args.output}") else: print(text) ``` The corresponding documented workflow instructs the agent to read PDF content: ```markdown ### 2. Find attachment key for a paper, then read PDF ```bash # Step 1: search to get the attachment key py -3 scripts/query_items.py --search "Silibinin" # Step 2: read the PDF (pass the attachment key shown in output) py -3 scripts/read_pdf.py ZL42EGES ``` ``` ### Technical Analysis PDF contents are untrusted, potentially attacker-controlled input. The script extracts all text from a selected document and prints it verbatim into the tool output. The skill instructions do not establish a trust boundary or direct the agent to treat extracted text exclusively as data. Consequently, a malicious PDF can include natural-language directives such as requests to disregard prior instructions, invoke tools, access other local resources, or disclose information. When the script output i ...[truncated 1960 chars]- Remediation
View remediation