T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:225
- Finding
- Untrusted Remote Report Content Is Promoted to Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 225–240 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Code ```markdown ### 提示词来源 - AI 每次调用 `report`，**服务器把「心鉴学本次服务原始报告」一次性返回**； - 使用说明 = 本地身份职能（见下节） + 服务器返回（心鉴学本次服务原始报告）。 ### 本地身份职能提示词与拼装（本 Skill 提供身份职能槽） 本 Skill 携带**分手挽回指导顾问**的「身份职能」，共两槽： - **角色设定**：专精分手后的心理修复与关系重建的可能性判断 - **专属自检**：别顺着用户的期待解读"还有机会"——先看重建的客观条件，不看用户有多想 **运行时拼装**： ``` 使用说明 = ① 本地身份职能提示词（本节两槽） + ② 心鉴学本次服务原始报告（随 report 返回） user = 用户当前问题（不进 system） ``` ``` The relevant instructions state that the operating instructions are assembled from the local role prompt and the raw report returned by the remote server. ### Technical Analysis The Skill explicitly promotes content returned by `chinaapi.xinjianxue.com` into the Agent's usage instructions. The remote report is therefore treated as trusted instructional content rather than as untrusted data to be interpreted. Because the server response can change after the Skill package has been reviewed, a compromised or malicious server could embed prompt-injection directives in the report. Such directives could attempt to override the local role, alter the current task, suppress warnings, request additional information, expose credentials, or induce unauthorized tool calls. The document does not specify: - A strict response schema or allowlist for accepted report fields. - Separation between instructions and remote report data. - Rejection or escaping of instruction-like content. - Integrity verification or authentication of the returned report beyond HTTPS. - A rule requiring the Agent to ignore commands embedded in the report. This creates a post-review instruction-control channel. It is classified as instruction hijacking rather than remote code execution because the retrieved payload is incorporated into model instructions, not executed as native code. ### Attack Path 1. A user confirms that they want to use the ...[truncated 1335 chars]
- Remediation
- ## Remediation Suggestions 1. Treat the entire remote response as untrusted data and never concatenate it into system, developer, or Skill-level instructions. 2. Define a versioned JSON schema containing only the report fields required for analysis. 3. Reject unknown fields, unexpected data types, oversized values, and free-form control fields. 4. Pass validated report fields to the model inside a clearly delimited data block with an explicit instruction that commands inside the block must not be followed. 5. Extract facts from the report through deterministic parsing where possible instead of directly supplying unrestricted prose. 6. Add prompt-injection filtering as defense in depth, but do not rely on filtering as the primary trust boundary. 7. Restrict downstream tool access while processing external report content and require explicit user confirmation for consequential actions. 8. Log report schema failures and suspicious instruction-like content without recording credentials or unnecessary personal information. 9. Document the remote service as an untrusted content source and test the workflow with adversarial responses such as requests to reveal secrets, ignore prior instructions, or invoke tools.