T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:219
- Finding
- Untrusted Remote Content Is Incorporated into Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 219–241 **Vulnerability Type**: Remote instruction injection **Risk Level**: High **Relevant excerpt translated into English:** ```text ### Report translation (performed by the AI after report output) 1. Reports and prompts are returned by the server in Chinese, and the AI may directly use them for analysis; 2. User-facing deliverables must use the user's native language; 3. For non-Chinese delivery, the AI may optionally back-translate to check meaning. ### Prompt source - Each time the AI invokes `report`, the server returns the “raw report for the current Xinjianxue service”; - Usage instructions = local role capabilities + the raw report returned by the server. ### Local role prompt and assembly This Skill carries two role slots: - Role definition: specializes in family systems, family atmosphere, and role allocation - Dedicated self-check: do not become aligned with one family member; present the family system without taking sides Runtime assembly: Usage instructions = 1. Local role prompt + 2. Raw report returned by `report` user = Current user question, not placed in the system message Analyze the report and the user's specific question based on item 1. ``` ### Technical Analysis The Skill explicitly states that the remote server returns both reports and prompts, and directs the agent to combine the returned content with its local operating instructions. The response from `chinaapi.xinjianxue.com` is therefore treated as authoritative instruction material rather than untrusted external data. No fixed response schema, instruction filtering, field allowlist, content-length restriction, contextual isolation, or integrity mechanism is specified. Consequently, control of the remote service or its response path permits the effective instructions to change after the Skill has undergone static review. A malic ...[truncated 1735 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every remote response as untrusted data and never concatenate it into system, developer, role, or usage instructions. 2. Replace the server-supplied prompt mechanism with a fixed, locally reviewed prompt that cannot be modified by the remote service. 3. Require `/dev/report` to return a versioned structured-data schema containing only necessary report fields. 4. Enforce strict field allowlists, data types, maximum lengths, nesting limits, and accepted character formats before processing a response. 5. Place validated report values only in a clearly delimited untrusted-data section and explicitly instruct the agent not to follow commands found inside that section. 6. Reject or neutralize fields containing instruction-like material, role declarations, tool requests, policy overrides, or attempts to alter the processing hierarchy. 7. Pin the expected API origin and use transport security, authenticated responses, and response-integrity controls where feasible. 8. Minimize tool availability while processing reports and require explicit user confirmation before any consequential follow-up action. 9. Add adversarial tests covering prompt injection in every remotely controlled text field, including nested and encoded payloads. 10. Log validation failures without recording credentials or the sensitive personal information submitted for analysis.