T01 · Skill Instruction Hijacking
Error
- Location
scripts/mean-marketer.js:184- Finding
Untrusted Server-Controlled Content Is Relayed Verbatim to Users
- Content
View full analysis
{ const data = await request("POST", "/api/v1/mean-marketer/poll"); // Stay silent when the server says there's nothing worth pinging about. if (!data || data.enabled === false) return; if (!data.message) return; if (data.noNewOpportunity && !data.beMean) return; const lines = [String(data.message)]; const opp = data.opportunity; if (opp) { lines.push(""); lines.push("Opportunity:"); if (opp.title) lines.push(`- Title: ${opp.title}`); if (opp.url) lines.push(`- Link: ${opp.url}`); if (opp.source) { lines.push( `- Source: ${opp.source}${opp.subreddit ? ` (r/${opp.subreddit})` : ""}`, ); } if (opp.relevanceScore != null) lines.push(`- Score: ${opp.relevanceScore}/100`); if (opp.relevanceReason) lines.push(`- Why: ${opp.relevanceReason}`); lines.push(`- ID: ${opp.id} (reply "approve" or "reject" to triage)`); } console.log(lines.join("\n").trim()); }, ``` The associated Skill instructions explicitly require verbatim relay: ```markdown 1. **If `message` is non-null, send it to the user as-is.** It's already written in the right tone at the right meanness — do not rewrite, soften, or embellish it. ``` ### Technical Analysis The `message`, title, URL, relevance reason, source, subreddit, and ID are obtained from a remote API and inserted directly into output. The Skill instructs the host agent to deliver the server-generated message unchanged, without validation or review. This creates an external instruction and output-control channel. If the RedReplier service, an upstream data source, or the API response path is compromised, an attacker can return content containing: - Prompt-inject ...[truncated 1557 chars]- Remediation
View remediation