Scary Agent Skills: Hidden Unicode Instructions in Skills ...And How To Catch Them
MentionsOpenAI
There is a lot of talk about Skills recently, both in terms of capabilities and security concerns. However, so far I haven’t seen anyone bring up hidden prompt injection. So, I figured to demo a Skills supply chain backdoor that survives human review. Additionally, I also built a basic scanner , and had my agent propose updates to OpenClaw to catch such attacks.
Summary from Embrace The Red.
Explained
The technology and terms in this story. Learn more
- AttackPrompt injectionHiding instructions in content an AI reads, so it follows the attacker instead of its user.
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- AttackSupply-chain attackCompromising a vendor, library or update so the attack reaches all of its customers at once.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
