T01 · Skill Instruction Hijacking
- Location
SKILL.md:69- Finding
Untrusted RSS Content Is Processed Without an Instruction-Data Boundary
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 69-80 and line 115
Vulnerability Type: Indirect prompt injection through externally retrieved content
Risk Level: MediumVulnerable Code Snippet
text 1. 资源读取与抓取 → 读取RSS链接，获取最新文章并通读正文 2. 内容过滤 → 质量审查 + 跨源事件合并 3. 严格核对记忆 → 对比历史日志，剔除已推送内容 4. 撰写与排版 → 按输出规范生成纯文本简报text [支持] RSS链接列表自动读取 [支持] 文章正文抓取与通读 [支持] 内容质量审查（过滤垃圾/水文） [支持] 跨源事件合并 [支持] 历史日志去重（增量推送）text 2. 抓取每篇文章的正文内容Technical Analysis
The skill instructs an AI agent to retrieve and fully read arbitrary RSS entries and linked article bodies. It does not establish a security boundary that classifies retrieved text as untrusted data, nor does it tell the agent to ignore commands, tool requests, policy changes, or role instructions embedded in that content.
This creates an indirect prompt-injection surface. A malicious RSS publisher or compromised article can include text crafted to look like authoritative agent instructions. Because the skill declares access to
read,exec,glob, andgrep, successful instruction injection could influence tool calls within the permissions available to the hosting agent.The finding does not establish that the skill deliberately performs malicious actions. The risk arises from the absence of controls around content that the workflow necessarily imports into the model context.
Attack Path
- An attacker publishes or compromises an RSS feed or a linked article.
- The attacker embeds instructions in the feed or article body, such as requests to ignore the aggregation task, inspect local files, invoke a tool, or reveal information.
- A user adds the attacker-controlled source to the RSS configuration.
- The skill retrieves and reads the complete remote content as required by its workflow.
- The embedded instructions enter the model context without explicit delimitation or sanitization.
- The agent may interpret the hostile content as instructions rather than article ...[truncated 760 chars]
- Remediation
View remediation
Remediation Suggestions
- State explicitly that all RSS entries, article bodies, titles, metadata, and linked pages are untrusted data.
- Require the agent never to follow instructions found in retrieved content, including requests to call tools, read files, disclose data, change roles, override policy, or modify the workflow.
- Wrap retrieved content in clearly marked data delimiters and process only predefined fields.
- Parse RSS through a structured parser rather than presenting raw XML, HTML, or article pages directly as instructions.
- Strip scripts, hidden elements, comments, metadata instructions, and other non-content material before model processing.
- Apply least privilege by avoiding
exec,glob, and unrestricted local-file access during content summarization. - Separate retrieval, sanitization, and summarization into distinct stages. Only sanitized text should reach the summarization stage.
- Require explicit user confirmation before any fetched content can cause an operation outside summarization and history deduplication.
- Add regression tests containing common indirect prompt-injection patterns and verify that they are treated only as quoted article data.