T01 · Skill Instruction Hijacking
- Location
SKILL.md:22- Finding
Untrusted Remote Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-58
Vulnerability Type: Prompt injection through attacker-controlled remote content
Risk Level: MediumComplete Code Snippet
markdown 3. Extract all valid URLs from the sources file (one per line, ignore comments starting with #) ### Step 3: Fetch All New URLs (Batch) 1. **Detect URL type and select fetch strategy:** - **Twitter/X URLs:** Use FxTwitter API (see below) - **All other URLs:** Use web_fetch tool 2. **Fetch all content in parallel** using appropriate method for each URL 3. **Track fetch results:** - Successfully fetched: Store URL and content for processing - Failed fetches: Log the URL and failure reason for reporting 4. Continue only with successfully fetched content #### Twitter/X URL Handling Twitter/X URLs require special handling because they need JavaScript to render. Use the **FxTwitter API** instead: **Detection:** URL contains `twitter.com` or `x.com` **API Endpoint:** `https://api.fxtwitter.com/{username}/status/{tweet_id}` **Transform URL:** - Input: `https://x.com/gregisenberg/status/2012171244666253777` - API URL: `https://api.fxtwitter.com/gregisenberg/status/2012171244666253777` ### Step 4: Analyze All Content For each piece of fetched content, analyze using the **Content Deconstructor Guide** below: 1. Apply the full analysis framework to each pieceTechnical Analysis
The skill accepts URLs from a user-controlled source file and directs the agent to load their contents into its working context. Those contents are subsequently processed by the model without an explicit trust boundary or instruction to treat remote text solely as inert data.
An attacker can place prompt-injection directives in an article, tweet, or other remotely hosted resource. When the skill fetches that resource, the model may confuse the embedded directives with trusted workflow instructions. The skill does not require sanitization of hidden or active ...[truncated 1803 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly state that all fetched content is untrusted data and that instructions, requests, or tool directives appearing inside it must never be followed.
- Place remote content inside clear data delimiters and require the model to analyze only the delimited material.
- Extract only fields needed for analysis, such as title and visible body text, instead of placing complete responses or markup into the model context.
- Remove scripts, hidden elements, metadata, comments, and other non-content markup where the fetch mechanism permits.
- Validate URLs before fetching:
- Permit only
httpandhttps. - Reject embedded credentials and malformed hosts.
- Block loopback, link-local, private-network, and cloud-metadata destinations where relevant.
- Revalidate every redirect destination.
- Permit only
- Permit only the documented analysis and swipe-file updates while processing remote content. Require explicit user confirmation for any unrelated tool action.
- Prevent fetched content from selecting tools, changing safety constraints, requesting secrets, or modifying files outside the documented
swipe-file/paths. - Mark generated analysis as derived from untrusted material and safely quote any suspicious directives rather than reproducing them as operational instructions.