T01 · Skill Instruction Hijacking
Warning
- Location
scripts/auto-tweet.js:26- Finding
Untrusted X Trend Content Is Passed into the Agent Content-Generation Flow
- Content
View full analysis
{ const trendElements = document.querySelectorAll('[data-testid="trend"]'); return Array.from(trendElements).slice(0, 10).map(el => { const nameEl = el.querySelector('[dir="ltr"]'); const tweetCountEl = el.querySelector('span:last-child'); return { topic: nameEl ? nameEl.textContent : 'Unknown', tweets: tweetCountEl ? tweetCountEl.textContent : '0' }; }); }); ``` `scripts/auto-tweet.js:62-65`: ```js fs.writeFileSync(trendsFile, JSON.stringify({ timestamp: new Date().toISOString(), trends }, null, 2)); ``` `scripts/trends.js:25-36`: ```js const trends = await page.evaluate(() => { const trendElements = document.querySelectorAll('[data-testid="trend"]'); return Array.from(trendElements).slice(0, 10).map(el => { const nameEl = el.querySelector('[dir="ltr"]'); const tweetCountEl = el.querySelector('span:last-child'); return { topic: nameEl ? nameEl.textContent : 'Unknown', tweets: tweetCountEl ? tweetCountEl.textContent : '0', timestamp: new Date().toISOString() }; }); }); ``` `scripts/generate-ideas.js:20-25`: ```js const data = JSON.parse(fs.readFileSync(trendsFile, 'utf8')); const trends = data.trends; console.log('🔥 Top 5 Trending Topics:'); console.log('========================\n'); trends.slice(0, 5).forEach((trend, i) => { ``` `scripts/generate-ideas.js:38-42`: ```js // Return trends as JSON for agent to process console.log('\n---TRENDS_JSON---'); console.log(JSON.stringify(trends.slice(0, 5), null, 2)); console.log('---END_TRENDS_JSON---'); ``` ...[truncated 2478 chars]- Remediation
View remediation