T01 · Skill Instruction Hijacking
- Location
main.py:215- Finding
Prompt Injection Through Untrusted Danmaku Content
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 215-228
Vulnerability Type: Prompt injection through untrusted external content
Risk Level: HighVulnerable Code
python for seg in analysis_data['time_segments']: prompt += f"### 时段 {seg['segment']} (共 {seg['count']} 条弹幕)\n" if seg['samples']: for sample in seg['samples']: prompt += f"- [{sample['time']}] {sample['text']}\n" else: prompt += "- (此时间段无弹幕)\n" prompt += "\n"Technical Analysis
The application obtains publicly supplied danmaku from Bilibili and interpolates each sampled comment directly into a prompt intended for downstream LLM processing. The comments are attacker-controlled external data, but the generated prompt does not establish a clear trust boundary, encode the data in a structured data-only format, or instruct the downstream model to disregard instructions embedded in comments.
Because an LLM processes instructions and data as text, a malicious comment can contain directives such as requests to ignore the intended analysis requirements, produce attacker-selected output, conceal information, or invoke tools. The subsequent analysis instructions do not reliably neutralize such directives. Sampling limits exposure but does not eliminate it because an attacker can increase the likelihood that a malicious comment appears among the first sampled comments in a segment.
Attack Path
- An attacker posts instruction-like text as danmaku on a targeted Bilibili video.
- The skill downloads the comment through the public danmaku endpoint in
get_danmakus(). prepare_analysis_data()includes the malicious comment among the sampled comments.generate_analysis_prompt()inserts the comment verbatim into the generated prompt at line 228.- A user or agent submits the generated prompt to an LLM, as directed by the documented workflow.
- The LLM may interpret the em ...[truncated 991 chars]
- Remediation
View remediation
Remediation Suggestions
- Clearly identify all downloaded comments as untrusted data before and after the data block. Explicitly instruct the downstream model never to interpret text inside that block as commands, policies, or tool requests.
- Serialize comments as structured JSON rather than interpolating them into instruction-oriented Markdown. Keep system instructions and untrusted data in separate message or content channels where the downstream API supports this.
- Require the downstream model to analyze comment fields only and prohibit tool invocation or goal changes based on their contents.
- Normalize or reject control characters and unusual delimiters that could break out of the chosen data representation. Use a standard JSON serializer instead of manual concatenation.
- Validate the downstream response against an expected schema and reject output that contains unexpected actions, tool requests, or instruction changes.
- Run the analysis with no tools and minimum privileges whenever possible. If tools are necessary, require independent authorization before any consequential operation.
- Treat content filtering as defense in depth only; keyword-based removal cannot reliably prevent prompt injection.