T01 · Skill Instruction Hijacking
Error
- Location
- scripts/config.sh:147
- Finding
- Untrusted Obsidian Content Is Passed to Coding Agents with Security Controls Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan-obsidian.sh:55-56, 88-91`; `scripts/spawn-agent.sh:122-149`; `scripts/config.sh:147-173` **Vulnerability Type**: Prompt injection leading to unrestricted local agent execution **Risk Level**: Critical ### Vulnerable Code ```python desc_lines = re.findall(r'(?m)^>\s*(.+)$', block) if not desc_lines: print(f" Skip task (no description): {task_name}") continue task_desc = "\n".join(line.strip() for line in desc_lines) ``` ```python result = subprocess.run([ os.path.join(scripts_dir, 'spawn-agent.sh'), project, task_desc, '', 'normal', task_name, note_file, dedup_key ], capture_output=True, text=True) ``` ```bash { echo "You are working on project: ${PROJECT_NAME}" echo "Task: ${TASK_DESCRIPTION}" echo "Priority: ${PRIORITY}" echo "Working directory: ${WORKTREE}" echo "Branch: ${BRANCH_NAME}" echo "" echo "--- PROJECT CONTEXT ---" echo "${CONTEXT_SECTION}" echo "--- END CONTEXT ---" echo "" echo "Instructions:" echo "1. Read existing code carefully before making changes" echo "2. Follow existing code style and architecture" echo "3. Make clean atomic commits with clear messages" echo "4. When done: push branch to origin" echo "5. Do NOT create MR/PR — that will be handled automatically after review" echo "6. Run tests if available" echo "7. Definition of done: code committed + pushed to origin" echo "8. After completing all work, summarize what you did." echo "9. If your changes introduce new features, gameplay changes, new modules, architecture changes, or add key files, update context.md (${CONTEXT_PATH}) in the project root accordingly. Only skip for trivial config/formatting changes." echo "" echo "Start working now." } > "$PROMPT_FILE" ``` ```bash swarm_run_coding_agent() { local prompt="$1" log_file="$2" case "$SWARM_CODING_AGENT" in claude) claude --dangero ...[truncated 2318 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` and `--dangerously-bypass-approvals-and-sandbox` for all tasks derived from notes, repository files, or other mutable sources. 2. Run coding agents inside an isolated container or virtual machine with: - A task-specific writable worktree. - A read-only base filesystem where practical. - No access to the user’s home directory, SSH keys, cloud credentials, or unrelated repositories. - Restricted outbound network access. 3. Treat task descriptions and project context strictly as untrusted data. Clearly delimit them and prevent them from defining tool permissions. 4. Enforce allowed commands and writable paths outside the model prompt through a wrapper or sandbox policy. 5. Require explicit human approval before pushes, merge-request creation, credential access, or commands outside a narrow build/test allowlist. 6. Restrict write access to the Obsidian intake directory and project context files. 7. Record and review all agent tool calls and reject requests to access paths outside the assigned worktree. ]]>