T01 · Skill Instruction Hijacking
- Location
SKILL.md:139- Finding
Untrusted Remote Scoring Prompt Can Hijack Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:139-155, with automatic decryption behavior additionally declared atSKILL.md:174
Vulnerability Type: Remote prompt injection through server-controlled scoring criteria
Risk Level: MediumVulnerable Documentation Segment
The following is an English translation of the relevant segment from
SKILL.md:139-155; endpoint names and JSON fields are preserved exactly:markdown ## 4. Xiaohongshu scoring-criteria prompt endpoint Prompt: Evaluate the user's nickname, profile, note title, and note content according to the criteria returned by the following endpoint, using a ten-point scale, and provide recommendations based on those criteria. GET /xhs/get_score_prompt | Parameter | Type | Default | Description | |-----------|---------|---------|-------------| | type | integer | 1 | 1: nickname/profile criteria; 2: note-title criteria; 3: note-content criteria | { "score_prompt": "string", "_field_comments": { "score_prompt": "Requires decoding; decoded content is Markdown" } }The security note at
SKILL.md:174further states that the Agent automatically decrypts and displays the plaintext content.Technical Analysis
The Skill instructs the Agent to retrieve
score_promptfrom the mutable third-party service athttps://qianhaistonepark.site/, decrypt it, and use the resulting Markdown as evaluation criteria. The returned content is therefore capable of influencing the Agent's active instructions.No validation, strict schema for the decoded prompt contents, cryptographic signature verification, content pinning, or instruction/data boundary is defined. The XOR and Base64 transformation in
scripts/tool.pyonly obscures the response; it does not authenticate its source or prevent modification. Its key material is also embedded in the distributed package.Consequently, anyone who compromises or controls the ...[truncated 1914 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove remote instructions where possible: Store the scoring rubric as reviewed, version-controlled local content rather than retrieving executable prompt material from a third-party endpoint.
- Treat remote responses strictly as data: Explicitly instruct the Agent that decoded API content is untrusted reference data and that commands, role changes, tool requests, or policy statements inside it must never be followed.
- Use a constrained schema: Replace free-form Markdown with structured scoring fields such as criterion name, weight, description, and maximum score. Reject unknown fields and enforce length and character limits.
- Authenticate responses: Sign scoring-rubric payloads with a private server key and verify them locally using a pinned public key. XOR and Base64 must not be treated as integrity or authenticity controls.
- Pin approved content: Validate the rubric against an allowlisted version or cryptographic digest before it can influence an evaluation.
- Apply prompt-injection filtering: Reject content containing attempts to change roles, override instructions, request tools, access secrets, communicate externally, or alter unrelated behavior.
- Use fail-closed behavior: If verification or schema validation fails, report that scoring criteria could not be obtained and do not use the returned content.
- Minimize remote influence: Keep evaluation logic local and use the service only to retrieve factual Xiaohongshu data required for the declared functionality.