T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:59
- Finding
- Unauthenticated Chat Messages Can Impersonate Persistent System Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–93 **Vulnerability Type**: Unauthenticated instruction execution and persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ### 2. 配置 AGENTS.md 在 `AGENTS.md` 的「Every Session」部分添加： ```markdown ## Every Session 1. 读取 `SOUL.md` 2. 读取 `USER.md` 3. 读取 `memory/YYYY-MM-DD.md`（今天 + 昨天） 4. **群聊记忆**：如果是群聊环境（chat_id 以 `oc_` 开头）： - **读取记忆**：加载 `memory/FeishuGroupMemory/{chat_id}.md` 恢复上下文 - **系统指令处理**：收到 `[SYSTEM]` 开头的消息时执行对应操作（如保存记忆） ``` ### 3. 配置 SOUL.md 在 `SOUL.md` 中添加群聊感知规则： ```markdown ## 群聊感知 **识别群聊环境**：检查 inbound context 中的 `chat_id`，如果以 `oc_` 开头则是群聊。 **Session 启动时**：如果是群聊环境，自动读取 `memory/FeishuGroupMemory/{chat_id}.md` 恢复上下文。 **保存记忆**：当用户说"保存上下文"或心跳检查时，将对话总结保存到 `memory/FeishuGroupMemory/{chat_id}.md`。 **加载记忆**：当用户说"加载上下文"时，读取对应群聊的记忆文件。 **系统指令识别**：收到 `[SYSTEM]` 开头的消息时： - **不回复给用户**（这是内部指令，不是用户消息） - **识别指令类型**： - `[SYSTEM] 执行群聊记忆保存` → 执行保存逻辑 - 其他 `[SYSTEM]` 指令 → 根据指令内容执行对应操作 ``` ``` ### Technical Analysis The skill directs operators to modify the persistent `AGENTS.md` and `SOUL.md` instruction files so that any inbound message beginning with `[SYSTEM]` is treated as an internal command. The message prefix is ordinary chat content and does not establish that the message originated from a trusted platform component. No sender authorization, authenticated event type, cryptographic signature, trusted transport metadata, or strict command allowlist is required. In particular, the instruction to process all other `[SYSTEM]` messages according to their content creates an open-ended command channel rather than limiting behavior to the documented memory-save operation. The instruction also suppresses a response to the user, reducing the visibility of exploitation. Because the behavior is added to files loaded across sessions, the unsafe trust rule persists beyond the current skill invocation. This combines current-session instruction hijacking ...[truncated 1650 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the rule that identifies system instructions through a user-visible text prefix such as `[SYSTEM]`. 2. Accept internal events only through authenticated platform metadata or a separate trusted control channel that users cannot populate. 3. Verify the event type, sender identity, chat identifier, and authorization state before performing any memory or file operation. 4. Delete the unrestricted fallback behavior for “other” system instructions. 5. Implement a strict allowlist of narrowly defined operations, such as `save_group_memory`, with schema validation and no interpretation of arbitrary natural-language commands. 6. Require explicit administrator or authorized-user confirmation before sensitive writes or tool invocations. 7. Do not install this trust rule into global persistent files such as `AGENTS.md` or `SOUL.md`. Keep skill-specific behavior scoped to the skill and current authorized invocation. 8. Treat all loaded chat summaries and memory files as untrusted data, not executable instructions. 9. Log authenticated control events and resulting actions to an auditable channel rather than silently suppressing all responses. 10. Review and remove the unsafe instructions from any existing `AGENTS.md` and `SOUL.md` deployments. ]]>