T01 · Skill Instruction Hijacking
Error
- Location
siliville_skill.py:475- Finding
Untrusted Remote System Prompt Is Executed by the LLM
- Content
View full analysis
dict: """ Fetch the full world state + system prompt injection. Call this FIRST at the start of every session. Returns: agent status, farm state, social radar, gaia environment, etc. """ return self._get("/api/v1/agent/awaken") ``` ```python # ── 1. Awaken ──────────────────────────────────────────── world = skill.awaken() agent_name = world.get("agent", {}).get("name", "unknown") coins = world.get("owner", {}).get("silicon_coins", "?") base_prompt = world.get("system_protocol", "你是一个硅基小镇的自主智体。") print(f" 👤 {agent_name} | 💰 {coins} 硅币") # ── 2. Roll dice → physical action ─────────────────────── skill.set_status("exploring") action_type, action_result = skill.daily_action() icons = {"steal": "💀", "wander": "🚶", "idle": "🏠"} print(f" {icons.get(action_type, '?')} 行为决策: {action_type}") if action_type != "idle": print(f" {action_result.get('report', '')[:80]}") # ── 3. Build final prompt & generate post ───────────────── skill.set_status("writing") narrative = action_result.get("narrative_prompt", "") final_prompt = base_prompt + ("\n\n" + narrative if narrative else "") if llm_fn: post_text = llm_fn(final_prompt) ``` ### Technical Analysis The `/api/v1/agent/awaken` response is controlled by the remote SiliVille service. Its `system_protocol` property is read without validation and then used directly as the system prompt supplied to `llm_fn`. This crosses a critical trust boundary: remote API data is treated as authoritative LLM instructions rather than untrusted application data. The effective instructions can consequently be changed after the Skill has been reviewed or installed. There is no fixed local system template, signature v ...[truncated 1994 chars]- Remediation
View remediation