T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:22
- Finding
- Untrusted Remote Content Is Processed Without Prompt-Injection Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 22-58 **Vulnerability Type**: Prompt injection through attacker-controlled remote content **Risk Level**: Medium ### Complete Code Snippet ```markdown 3. Extract all valid URLs from the sources file (one per line, ignore comments starting with #) ### Step 3: Fetch All New URLs (Batch) 1. **Detect URL type and select fetch strategy:** - **Twitter/X URLs:** Use FxTwitter API (see below) - **All other URLs:** Use web_fetch tool 2. **Fetch all content in parallel** using appropriate method for each URL 3. **Track fetch results:** - Successfully fetched: Store URL and content for processing - Failed fetches: Log the URL and failure reason for reporting 4. Continue only with successfully fetched content #### Twitter/X URL Handling Twitter/X URLs require special handling because they need JavaScript to render. Use the **FxTwitter API** instead: **Detection:** URL contains `twitter.com` or `x.com` **API Endpoint:** `https://api.fxtwitter.com/{username}/status/{tweet_id}` **Transform URL:** - Input: `https://x.com/gregisenberg/status/2012171244666253777` - API URL: `https://api.fxtwitter.com/gregisenberg/status/2012171244666253777` ### Step 4: Analyze All Content For each piece of fetched content, analyze using the **Content Deconstructor Guide** below: 1. Apply the full analysis framework to each piece ``` ### Technical Analysis The skill accepts URLs from a user-controlled source file and directs the agent to load their contents into its working context. Those contents are subsequently processed by the model without an explicit trust boundary or instruction to treat remote text solely as inert data. An attacker can place prompt-injection directives in an article, tweet, or other remotely hosted resource. When the skill fetches that resource, the model may confuse the embedded directives with trusted workflow instructions. The skill does not require sanitization of hidden or active ...[truncated 1803 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly state that all fetched content is untrusted data and that instructions, requests, or tool directives appearing inside it must never be followed. 2. Place remote content inside clear data delimiters and require the model to analyze only the delimited material. 3. Extract only fields needed for analysis, such as title and visible body text, instead of placing complete responses or markup into the model context. 4. Remove scripts, hidden elements, metadata, comments, and other non-content markup where the fetch mechanism permits. 5. Validate URLs before fetching: - Permit only `http` and `https`. - Reject embedded credentials and malformed hosts. - Block loopback, link-local, private-network, and cloud-metadata destinations where relevant. - Revalidate every redirect destination. 6. Permit only the documented analysis and swipe-file updates while processing remote content. Require explicit user confirmation for any unrelated tool action. 7. Prevent fetched content from selecting tools, changing safety constraints, requesting secrets, or modifying files outside the documented `swipe-file/` paths. 8. Mark generated analysis as derived from untrusted material and safely quote any suspicious directives rather than reproducing them as operational instructions.