T01 · Skill Instruction Hijacking
Error
- Location
scripts/prompt-assembler.js:27- Finding
Untrusted Project Content Is Converted Directly into Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/prompt-assembler.js:27-74; workflow usage inSKILL.md:54-58
Vulnerability Type: Prompt injection through untrusted project content
Risk Level: HighVulnerable Code
javascript const outline = fs.readFileSync(outlineFile, 'utf-8'); const loadDb = (name) => { const p = path.join(projectDir, name + '.json'); return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf-8')) : {}; }; const charactersDb = loadDb('characters'); const foreshadowingDb = loadDb('foreshadowing'); const summaryDb = loadDb('summary'); let promptOutput = `# 章节 ${chapNum} 写作任务\n\n## 章节大纲\n${outline}\n\n`; const chapterSummaries = summaryDb.chapterSummaries || []; const recentSummaries = chapterSummaries.slice(-10); promptOutput += `## 最近剧情摘要\n`; if (recentSummaries.length > 0) { recentSummaries.forEach(s => { promptOutput += `- 第 ${s.chapter} 章 ${s.title}: ${s.summary}\n`; }); } const activeForeshadowing = (foreshadowingDb.foreshadowing || []).filter(f => f.status === 'planted' || f.status === 'reinforced'); promptOutput += `\n## 活跃关键伏笔\n`; if (activeForeshadowing.length > 0) { activeForeshadowing.forEach(f => { promptOutput += `- ${f.name} (第 ${f.plantedChapter} 章埋设, ${f.expectedResolution})\n`; }); } const activeChars = (charactersDb.characters || []).filter(c => c.status === 'active'); promptOutput += `\n## 活跃角色状态参考\n`; activeChars.forEach(c => { let details = c.profile ? c.profile.background : "无背景描述"; let curState = c.currentState ? c.currentState.physical : "未知身体状况"; promptOutput += `- ${c.name} (${c.role}): ${details} [当前状态: ${curState}]\n`; }); promptOutput += `\n**指令**：\n请根据以上上下文和章节大纲，严谨、优美地续写第 ${chapNum} 章的具体小说内容，字数要求 3000 字以上。\n`; console.log(promptOutput);Technical Analysis
The prompt assembler reads outline content and multiple persistent JSON databases, then interpolates their fields ...[truncated 2076 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat outlines and all database values as untrusted data rather than instructions.
- Add a clear, high-priority prompt rule stating that text inside project-data blocks is reference material and must never be followed as commands.
- Place each data source in strongly delimited or structured blocks and distinguish trusted instructions from untrusted content.
- Validate each JSON database against a strict schema, including expected types, maximum lengths, permitted status values, and allowed fields.
- Reject or neutralize prompt-control patterns in imported data where practical, while preserving legitimate prose.
- Require explicit user confirmation before loading projects obtained from untrusted or shared sources.
- Do not allow generated content to authorize tool execution. Tool calls should require separate policy checks and, for sensitive operations, user confirmation.
- Add regression tests containing adversarial outline and database values to verify that embedded instructions are treated only as data.