T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/check_upcoming.py:24
- Finding
- Stored Indirect Prompt Injection Through Schedule Reminder Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:159-159`, `SKILL.md:182-182`; `scripts/check_upcoming.py:24-39` **Vulnerability Type**: Stored indirect prompt injection across an autonomous agent boundary **Risk Level**: Medium ### Vulnerable Code The reminder formatter incorporates user-controlled schedule fields into a message: ```python def format_reminder(schedules): """Format upcoming schedules as a reminder message.""" if not schedules: return None lines = ["⏰ Schedule reminder! The following schedules are about to begin:", ""] for s in schedules: start = datetime.strptime(s["start_time"], DATE_FMT) now = datetime.now() minutes_left = int((start - now).total_seconds() / 60) loc = f" | 📍 Location: {s['location']}" if s.get("location") else "" lines.append(f"📅 {s['title']}") lines.append(f" ⏰ {s['start_time']} (starts in approximately {minutes_left} minutes){loc}") if s.get("description"): lines.append(f" 📝 {s['description']}") lines.append("") ``` The autonomous cron instructions require an agent to read the generated JSON and forward its `message` field verbatim: ```json { "message": "AUTONOMOUS: Execute the team schedule reminder check. Steps: 1) Execute python3 schedule-manager/scripts/check_upcoming.py 2) Read the output JSON 3) If status is reminders_sent, send the contents of the message field verbatim to the user as a reminder. If status is no_upcoming, take no action. Do not reply HEARTBEAT_OK." } ``` ### Technical Analysis Schedule titles, descriptions, and locations originate from users of the shared calendar. These values are stored in SQLite and later included without a trust-boundary marker in output consumed by an autonomous language-model session. The cron workflow asks the agent to interpret the script output and act on it. Consequently, a malicious schedule value can contain text that resembles agent instruct ...[truncated 1895 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the language model from the reminder delivery path. Have a deterministic component parse the script's structured JSON and send the rendered message directly through a narrowly scoped messaging API. 2. Preserve schedule data as separate structured fields rather than combining it with autonomous instructions. 3. If an agent must remain involved, define schedule fields explicitly as untrusted data that must never be treated as instructions. 4. Restrict the cron session to the minimum required tool set, ideally allowing only execution of the reminder script and delivery to a preconfigured destination. 5. Enforce an output schema and reject any attempted destination, tool, command, or task change originating from schedule fields. 6. Consider validating or limiting calendar text length and control characters. Content filtering can provide defense in depth but must not be the primary security boundary. 7. Add adversarial tests using schedule values that contain instruction-like text and verify that no additional tool calls occur. ]]>