T01 · Skill Instruction Hijacking
Error
- Location
pdf_reader/template/manager.py:68- Finding
Persistent Untrusted Instructions Are Forwarded to the Hosting Agent
- Content
View full analysis
str: """Define or overwrite a template.""" self._load() if "templates" not in self._data: self._data["templates"] = {} self._data["templates"][name] = prompt self._save() return f"✅ Template defined: {name}" def use(self, name: str) -> str: """Select the current template.""" self._load() if name not in self._data.get("templates", {}): return f"❌ Template does not exist: {name}" self._data["current"] = name self._save() return f"✅ Template selected: {name}" ``` The stored prompt is subsequently inserted into the result: ```python template = self.template_mgr.get_current_prompt() if not template or template == "请直接输出原文。": return result text = self._block_text(result) if not text: return result result = dict(result) result["template_payload"] = { "template_prompt": template, "original": text, "page": result.get("page", 1), "block_id": result.get("block_idx", 0), } ``` The formatter then explicitly directs the hosting Agent to process that prompt: ```python payload = data.get("template_payload") if payload: output.append("") output.append(f"--- [{PAYLOAD_MARKER}] ---") output.append("Agent: 请用下方 template_prompt 对 original 调用 LLM 加工（如 原文/翻译/解读），将 LLM 输出呈现给用户。") output.append(json.dumps(payload, ensure_ascii=False)) output.append(f"--- [/{PAYLOAD_MARKER}] ---") ``` ### Technical Analysis The `模板 定义` command accepts arbitrary prompt content without validation, stores it persistently in `templates.json`, and allows the stored prompt to be selected for future PDF operations. ...[truncated 2489 chars]- Remediation
View remediation