T01 · Skill Instruction Hijacking
Error
- Location
scripts/lbuild-epub.mjs:122- Finding
Untrusted MDX Content Can Hijack Delegated Conversion Agents
- Content
View full analysis
.svg) 图片语法，请把这些图片转换为，不要保留 mermaid 源码。`; const promptFile = path.join(OEBPS, "Text", `._prompt_${slug}.txt`); await fs.writeFile(promptFile, prompt, "utf8"); ``` The LaTeX converter uses the same unsafe construction: ```javascript const prompt = `${PROMPT_TEMPLATE} --- ## 待转换的 MDX 文件（${f}）： \`\`\`mdx ${mdxForLlm} \`\`\` --- 请立即开始转换。只输出 LaTeX 代码，不要任何解释。输出文件第一行必须是 \\chapter{...} 或 \\chapter*{...}。 注意：mermaid/plantuml 代码块已被预处理为 \\begin{figure}...\\end{figure} 引用，请保留这些 LaTeX 代码原样，不要再尝试渲染或处理 mermaid 源码。`; const promptFile = path.join(texDir, `._prompt_${slug}.txt`); await fs.writeFile(promptFile, prompt, "utf8"); ``` ### Technical Analysis The converters interpolate the complete MDX source directly into a prompt that is subsequently consumed by a delegated LLM agent. The source is surrounded by a Markdown fence, but that fence is not a security boundary. An attacker-controlled MDX document can include a closing fence followed by new instructions. Neither prompt clearly establishes that the embedded MDX is untrusted data whose instructions must never be followed. The generated conversion plan explicitly directs a Task or sub-agent to read the combined prompt file. If that agent has filesystem or tool permissions, malicious instructions in the MDX may influence more than the intended format conversion. ### Attack Path 1. An attacker supplies source material or an MDX chapter containing a fence-breaking payload. 2. T ...[truncated 1072 chars]
- Remediation
View remediation