T01 · Skill Instruction Hijacking
Error
- Location
- scripts/assembler.py:346
- Finding
- Agent Session Instruction Hijacking Through Prompt-Ready Context Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/assembler.py:346-457`; supporting usage instructions at `SKILL.md:30-42` **Vulnerability Type**: Agent prompt and behavior hijacking **Risk Level**: High ### Vulnerable Code ```python # scripts/assembler.py:346-356 agent_name = os.environ.get("AGENT_NAME", "your personal AI agent") identity = f"""=== IDENTITY [永久] === 你是 {agent_name} 的 personal AI agent。你有深度分析能力和自我进化机制。 """ blocks.append(identity) used += len(identity) date_str = datetime.now().strftime("%Y-%m-%d") task_block = f"""=== TASK CONTEXT === 任务: {task_desc} 时间: {date_str} (GMT+8) """ blocks.append(task_block) used += len(task_block) ``` ```python # scripts/assembler.py:376-386 # Add context snippets for high-relevance hits (up to 3) high_relevance = [r for r in memory_results if r["relevance"] == "high"][:3] for r in high_relevance: snippet = r["text"][:300].replace("\n", " ") line = f" 摘要: {snippet}\n" if len(line) <= remaining: mem_lines.append(line) remaining -= len(line) ``` ```python # scripts/assembler.py:411-424 if forbidden: forb_header = "=== FORBIDDEN PATTERNS [历史失败，禁止重试] ===\n" forb_lines = [forb_header] remaining = char_budget - used for fp in forbidden[:5]: ln = f"{fp}\n" if len(ln) <= remaining: forb_lines.append(ln) remaining -= len(ln) forb_block = "".join(forb_lines) blocks.append(forb_block) used += len(forb_block) ``` ```python # scripts/assembler.py:427-432 if profile.get("require_rules_core"): rules = """=== CORE RULES === - 操作前先写方案，等确认再动手 - trash > rm（删文件优先回收站） - 严格按事实陈述，标明信源 """ blocks.append(rules) used += len(rules) ``` ```python # scripts/assembler.py:455-457 # ── Block 7: Task Directive ── blocks.append(f"\n=== TASK ===\n{task_desc}\n") return "".join(blocks) ``` The documentation directs callers to place this output before the agent reasons: ```markdown <!-- SKILL.md:30-42 --> Task arrives → ...[truncated 2926 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Return structured data, such as JSON, instead of a prompt-ready instruction block. Separate fields should identify retrieved memories, timeline entries, and metadata. 2. Remove the permanent identity declaration, mandatory core rules, generated prohibitions, and repeated task directive from assembler output. 3. Treat `MEMORY.md`, daily notes, preference files, task descriptions, and environment variables as untrusted data. 4. Place retrieved content inside explicit data delimiters and state that it is reference material that cannot override system, developer, safety, or user instructions. 5. Validate and length-limit `AGENT_NAME` and task text. Reject control characters and instruction delimiters where practical. 6. Do not translate repeated failure titles into mandatory “do not retry” instructions. Return them as historical observations requiring independent validation. 7. Require the consuming agent to resolve instructions according to the established authority hierarchy and to ignore instructions embedded in retrieved content. 8. Add adversarial tests using memory entries and environment values containing prompt-injection payloads. Verify that they remain quoted data and cannot create new instruction sections. 9. If prompt insertion remains an intentional feature, document it explicitly as prompt modification and require informed opt-in by the caller. ]]>