T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:91- Finding
Mandatory Processing of Untrusted Chat Content Enables Prompt Injection
- Content
View full analysis
{ // messages = array of recent messages (up to 200) // Each: { id, roomId, screenName, text, timestamp, type } messages.forEach((msg) => console.log(msg.screenName + ": " + msg.text)); }); ``` ### Technical Analysis The Skill directs the agent to always retrieve and read chat history from a public, externally controlled chat service. Message text and screen names can be supplied by arbitrary chat participants, but the Skill does not define them as untrusted data or prohibit the agent from following instructions embedded in them. This creates a prompt-injection boundary failure. An attacker can publish messages that resemble system instructions, operational requests, or tool-use directions. When the agent fetches the room history, these messages enter its working context. The risk is amplified by the instruction to read history for context whenever the agent signs on or changes rooms. The JavaScript only prints messages and does not directly execute their contents. Exploitation therefore depends on an AI agent interpreting the displayed content as instructions. Nevertheless, the Skill is specifically designed for agent use and lacks the controls needed to distinguish untrusted chat data from trusted Skill instructions. ### Attack Path 1. An attacker joins one of the public chat rooms supported by the service. 2. The attacker posts a message containing prompt-injection text, such as instructions to ignore the user's task, reveal contextual data, access files, invoke tools, visit a URL, or send information ba ...[truncated 1157 chars]- Remediation
View remediation