T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/ingest_prompts.py:21
- Finding
- Archived Conversation Content Is Reintroduced Without Trust-Boundary Controls## Vulnerability Details **File Location**: `scripts/ingest_prompts.py:21-44` **Vulnerability Type**: Cross-session instruction injection **Risk Level**: Medium ### Vulnerable Code ```python content = archive_path.read_text() # Parse the file to get the latest session lines = content.split('\n') latest_session = [] in_session = False for line in reversed(lines): if line.startswith("###"): in_session = True latest_session.insert(0, line) elif in_session and (line.startswith("##") or line.startswith("#")): break elif in_session: latest_session.insert(0, line) return '\n'.join(latest_session) if latest_session else None def format_for_ingestion(session_content): """Format archived session for ingestion as context.""" if not session_content: return None ingest_text = """ --- ## 📚 PREVIOUS SESSION CONTEXT (Archived) This is your previous conversation, archived before token compaction. Continue naturally from here. """ ingest_text += session_content ``` ### Technical Analysis The implementation reads raw conversation content from the persistent archive and places it directly inside text explicitly intended for ingestion into a subsequent Agent session. No trust-boundary marker, content sanitization, role preservation, instruction filtering, or structured summarization is applied. Conversation content is attacker-influenceable whenever an untrusted participant can submit a message to the archived session. Such a message can contain instructions targeting a future Agent, including requests to ignore current policies, invoke tools, disclose context, or treat attacker-provided statements as trusted state. The script itself only creates and prints an ingestion document; it does not directly call an Agent API. Exploitation therefore depends on the generated content being ingested manually or by the integrati ...[truncated 1278 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all archived conversation text as untrusted data, not executable instructions. 2. Preserve message roles and boundaries in a structured format such as JSON rather than concatenating raw Markdown. 3. Generate a constrained factual summary instead of restoring messages verbatim. 4. Remove or neutralize embedded tool directives, role-change requests, system-prompt imitations, and instructions directed at future sessions. 5. Prepend an explicit control instruction stating that archived content is quoted historical data and that instructions inside it must not be followed. 6. Require explicit user review before supplying generated content to an Agent. 7. Where supported, pass historical messages through a dedicated data/context channel that cannot override system or developer instructions.