T01 · Skill Instruction Hijacking
- Location
scripts/feeds.py:93- Finding
Untrusted RSS Content Is Passed Into the Agent Context Without an Explicit Trust Boundary
- Content
View full analysis
Vulnerability Details
File Location:
scripts/feeds.py:93-116; related presentation instructions inSKILL.md:76-101
Vulnerability Type: Indirect prompt injection through attacker-controlled feed content
Risk Level: MediumVulnerable Code
python for entry in feed.entries: title = entry.get("title", "").strip() if not title: continue link = entry.get("link", "") published = entry.get("published", entry.get("updated", "")) summary = clean_html(entry.get("summary", "")) # Truncate long summaries if len(summary) > 500: summary = summary[:497] + "..." entries.append({ "title": title, "url": link, "source": domain, "date": published, "summary": summary, })The skill subsequently instructs the agent to process these fields:
markdown ## Presenting Results After parsing the output, present a structured, concise rundown: 1. **Group by theme** — cluster related stories under headings 2. **Keep it tight** — headline + one-line summary + source attribution per item 3. **Link to sources** — use markdown links so the user can read more 4. **Deduplicate** — if multiple feeds cover the same story, mention it once 5. **Highlight big stories** — if a story appears across 3+ sources, call it out prominentlyTechnical Analysis
RSS entry titles, summaries, and links are controlled by external publishers. A compromised publisher, malicious feed entry, or network attacker capable of modifying a feed can insert instruction-like text into these fields.
clean_html()strips HTML tags and normalizes whitespace, but it does not establish a semantic trust boundary or identify the resulting text as untrusted data. Consequently, the emitted JSON can contain statements such as instructions to ignore the current task, disclose information, misrepresent articles, or invoke tools.T ...[truncated 1440 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit instruction to
SKILL.mdthat every RSS field is untrusted data and must never be interpreted as an instruction. - Require the agent to ignore commands, requests, role declarations, tool instructions, and policy-like text appearing inside feed fields.
- Present entries through a fixed template that treats each field as quoted data rather than free-form agent input.
- Validate article links before presentation and permit only expected
httpsURLs. - Consider detecting and flagging instruction-like content in titles and summaries instead of presenting it normally.
- Keep tool invocation decisions separate from feed-derived content; feed text must never authorize tool use.
- Add regression tests containing adversarial RSS entries such as “ignore previous instructions” and verify that they are represented only as article content.
- Add an explicit instruction to