T01 · Skill Instruction Hijacking
Error
- Location
- migrate.py:347
- Finding
- Untrusted Dialogflow CX Content Is Embedded into Authoritative CES Instructions<![CDATA[ ## Vulnerability Details **File Location**: `migrate.py:347`, `migrate.py:359-375`, and `migrate.py:479-488` **Vulnerability Type**: Prompt injection through untrusted migration data **Risk Level**: High ### Vulnerable Code ```python # Add intent-based routing hints instructions.append("") instructions.append("## Intent routing hints:") for intent in intents: if intent.display_name.startswith("Default"): continue if intent.training_phrases: samples = [tp.parts[0].text for tp in intent.training_phrases[:2] if tp.parts] instructions.append(f"- '{intent.display_name}': triggered by phrases like {samples}") ``` ```python if page.entry_messages: instructions.append(f"Say: \"{page.entry_messages[0]}\"") if page.parameters: instructions.append("Collect the following information from the user:") for param in page.parameters: req = "required" if param.required else "optional" prompt = f" Ask: \"{param.prompts[0]}\"" if param.prompts else "" instructions.append(f" - **{param.name}** ({param.entity_type}, {req}).{prompt}") if page.routes: instructions.append("Transition rules:") for route in page.routes: if route["condition"] or route["messages"]: cond = route["condition"] or "after collecting parameters" msgs = f" Respond: \"{route['messages'][0]}\"" if route["messages"] else "" target = route["target"] instructions.append(f" - When {cond}:{msgs} → go to {target}") ``` ```python ces_agent = { "displayName": result.source_agent_name, "defaultLanguageCode": "en", "timeZone": "America/Los_Angeles", "description": f"Migrated from Dialogflow CX agent {result.source_agent_id}", "globalInstruction": "\n".join(result.root_agent_instructions), "agents": [], "tools": [], } for sub in result.sub_agents: ces_agent["agents"].append({ "displayName": sub.name, "description": sub.description, ...[truncated 2300 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all source-agent values as untrusted data rather than instruction text. 2. Represent routes, messages, parameters, and examples in structured CES fields wherever possible instead of concatenating them into system instructions. 3. Place unavoidable source text inside strongly delimited data blocks and explicitly state that quoted content must never be treated as instructions. 4. Escape control characters and Markdown constructs that can break out of the intended representation. 5. Detect instruction-like phrases, including attempts to override prior instructions, disclose data, or invoke tools. Block the migration or emit a high-visibility warning when such content is found. 6. Generate a review manifest listing every source value promoted into an instruction field. 7. Require explicit human approval before producing an importable file when untrusted content is present. 8. Add adversarial tests containing prompt-injection payloads in every migrated source field and verify that they cannot alter generated agent behavior. ]]>