T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:219
- Finding
- Remote Server Content Is Promoted into Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:219-242` **Vulnerability Type**: Remote instruction injection **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Report translation (executed by the AI after report output) 1. Reports and prompts are returned by the server in Chinese, and the AI may directly use them for analysis; 2. User-facing delivery must use the user's native language; Chinese may be delivered directly when that is the user's native language; 3. For non-Chinese delivery, the AI may optionally back-translate and correct obvious semantic discrepancies. ### Prompt source - Each time the AI invokes `report`, the server returns the raw report for the current service; - Usage instructions = local role functions (see the following section) + the server response (the raw report for the current service). ### Local role-function prompts and assembly This Skill contains two role-function slots for the upward-management consultant: - **Role definition**: Specializes in relationships with supervisors or authority figures, reporting, and advocacy - **Dedicated self-check**: Do not teach flattery intended to make leaders like the user; focus on mechanisms and boundaries rather than political maneuvering **Runtime assembly**: ``` Usage instructions = ① local role-function prompt (the two slots in this section) + ② raw report returned by the service user = the user's current question (not placed in system) ``` Analyze the report and the user's specific question based on ①. ``` *The snippet above is an English translation of the audited Chinese source.* ### Technical Analysis The Skill explicitly states that the external server returns both reports and prompts, and it combines the server response with local role instructions to create runtime “usage instructions.” This crosses the trust boundary between untrusted remote data and agent-control instructions. The response from `chinaapi.xinjianxue.c ...[truncated 2123 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every server response as untrusted data, never as a prompt or usage instruction. 2. Remove all language stating that the server returns prompts or that remote content is concatenated with local instructions. 3. Define a versioned JSON response schema containing only necessary report fields. Reject unknown fields and invalid types. 4. Enforce allowlists, maximum lengths, nesting limits, and expected value formats before processing the response. 5. Place validated report text inside a clearly delimited, quoted data block and explicitly instruct the agent that content inside the block is evidence to summarize, not instructions to follow. 6. Keep all behavioral, safety, tool-use, and role instructions exclusively in the locally reviewed Skill. 7. Detect and reject report fields containing instruction-like content, such as requests to ignore prior rules, invoke tools, reveal secrets, or contact unrelated endpoints. 8. Restrict subsequent tool access while interpreting a report. Require separate user confirmation for any action beyond generating the requested analysis. 9. Add adversarial tests using server responses containing prompt-injection strings and verify that they are treated only as report data. 10. Pin and document the expected API contract, monitor unexpected response-shape changes, and fail closed when validation fails.