T01 · Skill Instruction Hijacking
Error
- Location
- index.js:456
- Finding
- Untrusted Git Diff Content Can Inject Instructions into the AI Prompt<![CDATA[ ## Vulnerability Details **File Location**: `index.js:456-485` **Vulnerability Type**: Prompt injection through untrusted repository content **Risk Level**: High ### Vulnerable Code ```javascript // 返回分析请求 const systemPrompt = getSystemPrompt(language); // 构建输出，包含警告信息 let output = ''; if (warnings.length > 0) { output = `⚠️ 警告:\n${warnings.map(w => ` - ${w}`).join('\n')}\n\n---\n\n`; } output += `请根据以下 Git diff 生成 commit message: --- ## Git Diff 内容: \`\`\`diff ${diff} \`\`\` --- ## 分析要求: ${systemPrompt} --- 请生成符合规范的 commit message，只输出 message 本身，不要其他解释。`; return output; ``` ### Technical Analysis The skill inserts the complete staged Git diff into an AI prompt without treating it as untrusted input. A Git diff may contain attacker-controlled text from source files, comments, documentation, test fixtures, filenames, or configuration files. Markdown code fences do not create a security boundary for a language model. An attacker can stage text that instructs the model to ignore the commit-message task, disclose available context, generate unrelated content, or attempt to invoke tools. The generated prompt does not explicitly prohibit following instructions found inside the diff, and it does not use a structured or isolated data channel. The effective severity depends on the host agent. If the receiving model only returns text and has no tool access, the likely consequence is manipulation of the generated commit message. If the host processes the returned prompt in a tool-enabled agent context, the injection could attempt broader actions subject to that host's permissions and safety controls. ### Attack Path 1. An attacker contributes a tracked file containing instructions directed at an AI agent. 2. A user reviews or receives the repository changes and stages the malicious file with `git add`. 3. The skill executes `git diff --cached` and reads the attacker-controlled instructions. 4. The skill interpolates the diff verbatim into th ...[truncated 802 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Explicitly identify the diff as untrusted data and instruct the model never to follow commands or policy statements contained within it. 2. Place trusted instructions before and after the diff so that the trust boundary remains explicit. 3. Use structured model input or a dedicated data field instead of concatenating the diff into a natural-language instruction when the host API supports it. 4. Ensure the model invocation used for commit-message generation has no tool access and receives no unrelated sensitive context. 5. Neutralize or encode delimiter-like content so repository text cannot imitate the surrounding prompt structure. 6. Consider preprocessing the diff into a restricted representation containing file paths and changed code rather than arbitrary prose. 7. Add adversarial tests containing phrases such as “ignore previous instructions” and verify that the output remains a single valid commit message. 8. Validate the model response against the required commit-message format and reject responses containing commands, explanations, multiple lines, or unexpected content. ]]>