T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:23
- Finding
- Untrusted Group Messages Are Embedded Directly into Sub-Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-30 **Vulnerability Type**: Prompt injection across an agent delegation boundary **Risk Level**: Medium ### Vulnerable Code The non-ASCII source text is represented with equivalent Unicode escapes below to satisfy the report language requirement: ```python result = sessions_spawn( agentId="zhongshu", task="\u4e2d\u4e66\u7701\u8bf7\u6ce8\u610f\uff1a\u6536\u5230\u6765\u81ea [\u7fa4\u540d] \u7684\u6d88\u606f\uff1a[\u6d88\u606f\u5185\u5bb9]\u3002\u8bf7\u5904\u7406\u5e76\u56de\u590d\u3002", mode="run", timeoutSeconds=60 ) ``` The task template places the original group name and message content directly inside an imperative instruction passed to the delegated agent. ### Technical Analysis The routing instructions require attacker-controlled group-message content to be interpolated into the `task` argument of `sessions_spawn`. No structured separation, trust-boundary markers, escaping mechanism, authorization check, or explicit instruction to treat the embedded message solely as untrusted data is documented. Consequently, a group participant can submit content that resembles higher-priority operational instructions. Once interpolated, that content becomes part of the same natural-language task as the legitimate routing instruction. The delegated agent may interpret the malicious content as an instruction rather than as data to classify or answer. The subsequent requirement to forward the delegated agent's response to the original group provides an output channel for the manipulated result. ### Attack Path 1. An attacker obtains permission to post in one of the configured Feishu groups routed to a sub-agent. 2. The attacker submits a message containing prompt-injection instructions, such as directions to ignore the routing request, reveal accessible context, invoke available tools, or produce attacker-selected content. 3. The router inserts the group message directly i ...[truncated 1215 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pass the group message through a structured data field rather than concatenating it into an imperative natural-language task, where supported. 2. Clearly delimit untrusted content and state that text inside the delimiters is data, not instructions. For example, require the sub-agent to analyze only a separately supplied `message_content` field. 3. Instruct the delegated agent never to follow commands found in the original message that attempt to alter its role, policies, tool permissions, output destination, or routing workflow. 4. Validate both the source `chat_id` and the sender's authorization before delegation. Do not treat membership in a recognized group as sufficient authorization for privileged operations. 5. Apply least privilege to every sub-agent. Restrict tools, secrets, files, network access, and context to the minimum required for the assigned departmental function. 6. Require explicit approval before performing sensitive actions or returning sensitive information. 7. Validate and filter the delegated response before forwarding it to the original group. Reject responses containing secrets, unexpected tool output, or content outside the requested task. 8. Add adversarial tests covering instruction-override attempts, fake system messages, requests for hidden context, tool-use requests, and attempts to change the reply destination. ]]>