T01 · Skill Instruction Hijacking
Error
- Location
- references/prompts.md:8
- Finding
- Untrusted Repository Content Can Hijack Model Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:66-72`; `references/prompts.md:8-31` **Vulnerability Type**: Prompt injection through untrusted repository contents **Risk Level**: High ### Vulnerable Code `SKILL.md:66-72`: ```markdown 将扫描结果的 `files` 数组分批处理： - **每批最多 30 个文件**，或预估总内容不超过 60k tokens - 对每批，按 `references/prompts.md` 中的「Stage 1」prompt 模板，构造请求： - 将文件列表格式化为 `=== 文件: path ===\n<内容>` 的形式 - 让 Claude（自己）生成一个 JSON 对象 `{"文件路径": "摘要"}` - 合并所有批次的摘要，得到完整的 `code_summary` 字典 ``` `references/prompts.md:8-31`: ```text 你是一名资深软件工程师。请阅读以下代码文件列表，为每个文件生成一句话摘要（不超过30字），概括其业务功能。 只输出一个 JSON 对象，格式为 {"文件路径": "一句话摘要", ...}，不要任何多余内容。 注意： - 摘要要体现业务语义（如"处理用户登录逻辑"），而非技术细节（如"定义了3个类"） - 最多提及关键类名或方法名 - 不要超过30字 $FILES ``` The `$FILES` value is populated as follows: ```text === 文件: path/to/file1.py === <文件内容> === 文件: path/to/file2.java === <文件内容> ``` ### Technical Analysis The Skill directly inserts attacker-controlled source-file contents into an Agent prompt. The prompt does not establish that repository content is untrusted data and does not instruct the model to ignore commands, role changes, output overrides, or tool-use requests found inside source files. Comments, strings, documentation blocks, or other text in a scanned repository can therefore contain instructions that compete with the Stage 1 prompt. If followed, those instructions can alter the generated summary JSON. The resulting summaries are then trusted by Stage 2 and Stage 3, allowing the injected instructions to influence architecture nodes, file associations, relationship data, and Mermaid content. The output requirement to return JSON is not a security boundary. An attacker can ask the model to return syntactically valid but misleading or payload-bearing JSON. ### Attack Path 1. An attacker places instruction-like content inside a supported source file, such as a `.py`, `.js`, or `.ts` file. 2. `scan_repo.py` reads that file and returns its complete contents. 3. The Skill inserts ...[truncated 1101 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Explicitly state in every model prompt that repository content is untrusted data and that instructions found inside files must never be followed. 2. Enclose each file in a strongly delimited structured representation that separates trusted instructions from untrusted content. 3. Use separate message roles or structured tool payloads where supported instead of concatenating raw content into the instruction text. 4. Validate Stage 1 output against the scanner result: - Require exactly one summary for every scanned path. - Reject unknown or additional paths. - Reject missing paths. - Enforce string type and length limits. 5. Treat all Stage 1 output as untrusted when constructing Stage 2 and Stage 3 prompts. 6. Add adversarial tests containing source comments such as output overrides, role changes, fake system messages, and requests to omit files. 7. Consider using deterministic local parsing for basic metadata and limiting model processing to the minimum content necessary. ]]>