T01 · Skill Instruction Hijacking
Error
- Location
scripts/strategies.py:227- Finding
Untrusted Conversation Content Is Promoted to System-Level Instructions
- Content
View full analysis
100: topic += "..." user_topics.append(topic) elif role == "assistant": # 提取助手执行的动作 action = content[:100].strip() if len(content) > 100: action += "..." assistant_actions.append(action) elif role == "tool": # 简要记录工具结果 tool_name = msg.get("name", "unknown_tool") tool_results.append(f"{tool_name}") # 构建摘要文本 if user_topics: summary_parts.append(f"用户请求({len(user_topics)}条): " + "; ".join(user_topics[:5])) if len(user_topics) > 5: summary_parts[-1] += f" ...等{len(user_topics)}条" if assistant_actions: summary_parts.append(f"助手操作({len(assistant_actions)}条): " + "; ".join(assistant_actions[:5])) if len(assistant_actions) > 5: summary_parts[-1] += f" ...等{len(assistant_actions)}条" if tool_results: unique_tools = list(set(tool_results)) summary_parts.append(f"使用工具({len(tool_results)}次): " + ", ".join(unique_tools[:10])) summary_text = "[历史对话摘要] " + " | ".join(summary_parts) if summary_parts else "[历史对话摘要] 无重要内容" # 构建新的消息列表 summary_msg = { "role": "system", "content": summary_text, "_is_summary": True, "_summarized_count": len(old_messages), } # 检查是否已有摘要，如果有则合并 result = [summary_msg] + recent_messages return result, True ``` The structured-note strategy likewise extracts user or assistant text and appends it to a system messag ...[truncated 4876 chars]- Remediation
View remediation