T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:53
- Finding
- Untrusted GitHub Issue Content Is Injected Into a Sub-Agent Task## Vulnerability Details **File Location**: `SKILL.md`, lines 53–59 **Vulnerability Type**: Indirect prompt injection through attacker-controlled GitHub issue content **Risk Level**: High **Vulnerable Code Snippet**: ```python # Spawn agent to fix issue spawn_subagent( task=f"Fix GitHub issue #{issue_number}: {title}. {description}" ) ``` ### Technical Analysis The Skill directly interpolates a GitHub issue's `title` and `description` into the task given to a sub-agent. These fields are remotely controlled by issue authors and are not separated from trusted instructions, sanitized, or explicitly designated as untrusted data. An attacker can place prompt-injection instructions in an issue title or description. When the issue is delegated, the sub-agent may interpret those instructions as part of its authorized task rather than as data describing a defect. The documentation does not impose tool restrictions, repository boundaries, output constraints, or approval gates on the delegated agent. The authenticated GitHub network operations themselves are necessary for the declared issue-management functionality. No explicit token transmission, non-GitHub endpoint, executable payload, persistence behavior, or embedded malicious script was identified. The risk instead arises because untrusted content obtained from GitHub can influence an agent operating with local tools and authenticated GitHub access. ### Attack Path 1. An attacker creates or edits an accessible GitHub issue. 2. The attacker embeds instructions in the issue title or description, such as requests to inspect credentials, modify unrelated files, execute commands, or include sensitive content in a pull request. 3. The Skill retrieves the issue and interpolates its attacker-controlled fields into the `task` string. 4. `spawn_subagent` receives a mixture of trusted task instructions and untrusted issue content without a security boundary. 5. The sub-agent inter ...[truncated 999 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every issue field, comment, review, and linked document as untrusted data. 2. Place issue content in a clearly delimited data block and provide a higher-priority fixed instruction stating that instructions contained inside that block must never be followed. 3. Pass structured fields separately where supported instead of concatenating them into an executable natural-language task. 4. Restrict the sub-agent to the target repository and a dedicated worktree with no access to unrelated files, environment variables, credential stores, or repositories. 5. Grant only the minimum GitHub token scopes required. Prefer `gh` credential storage over exposing `GITHUB_TOKEN` to the sub-agent, and never include credentials in prompts, logs, commits, issues, pull requests, or comments. 6. Require explicit human approval before executing commands derived from issue content, pushing commits, opening pull requests, posting comments, or accessing files outside the designated worktree. 7. Validate the resulting diff and outbound content for secrets, unrelated changes, workflow modifications, and suspicious generated files before publication. 8. Use an allowlisted workflow: permit repository inspection, editing of relevant files, and approved tests while denying arbitrary network destinations and destructive shell operations. 9. Record which issue fields influenced each action so attempted prompt injection can be detected and audited.