T01 · Skill Instruction Hijacking
- Location
scripts/ingest_prompts.py:21- Finding
Archived Conversation Content Is Reintroduced Without Trust-Boundary Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ingest_prompts.py:21-44
Vulnerability Type: Cross-session instruction injection
Risk Level: MediumVulnerable Code
python content = archive_path.read_text() # Parse the file to get the latest session lines = content.split('\n') latest_session = [] in_session = False for line in reversed(lines): if line.startswith("###"): in_session = True latest_session.insert(0, line) elif in_session and (line.startswith("##") or line.startswith("#")): break elif in_session: latest_session.insert(0, line) return '\n'.join(latest_session) if latest_session else None def format_for_ingestion(session_content): """Format archived session for ingestion as context.""" if not session_content: return None ingest_text = """ --- ## 📚 PREVIOUS SESSION CONTEXT (Archived) This is your previous conversation, archived before token compaction. Continue naturally from here. """ ingest_text += session_contentTechnical Analysis
The implementation reads raw conversation content from the persistent archive and places it directly inside text explicitly intended for ingestion into a subsequent Agent session. No trust-boundary marker, content sanitization, role preservation, instruction filtering, or structured summarization is applied.
Conversation content is attacker-influenceable whenever an untrusted participant can submit a message to the archived session. Such a message can contain instructions targeting a future Agent, including requests to ignore current policies, invoke tools, disclose context, or treat attacker-provided statements as trusted state.
The script itself only creates and prints an ingestion document; it does not directly call an Agent API. Exploitation therefore depends on the generated content being ingested manually or by the integrati ...[truncated 1278 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all archived conversation text as untrusted data, not executable instructions.
- Preserve message roles and boundaries in a structured format such as JSON rather than concatenating raw Markdown.
- Generate a constrained factual summary instead of restoring messages verbatim.
- Remove or neutralize embedded tool directives, role-change requests, system-prompt imitations, and instructions directed at future sessions.
- Prepend an explicit control instruction stating that archived content is quoted historical data and that instructions inside it must not be followed.
- Require explicit user review before supplying generated content to an Agent.
- Where supported, pass historical messages through a dedicated data/context channel that cannot override system or developer instructions.