Security considerations: tool text can contain characters nobody sees
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 1/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 72/100
- Issue 类型
- 文档
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- markdown
调研方向
阅读现有的安全注意事项以及相关 issue #11、#159 和 #313，找到添加此说明的合适位置。简要、非规范性地说明工具文本中的不可见 Unicode 字符，以及建议实现者采取的预防措施。当安全注意事项包含所要求的指导，且没有引入规范性要求时，即为完成。
由索引模型根据 Issue 内容生成。
描述
This isn't a new attack, and it may be a minor thing, but I would like the security considerations to mention it so implementers of guardrails and agents don't forget it.
A tool's title, description and the strings inside its schemas can contain characters that take no space on screen but are still part of the text: Unicode tag characters (U+E0000 to U+E007F), which can spell out ASCII, zero-width characters, and bidirectional controls that reorder what a reader sees. A hidden instruction is no stronger than a visible one, but it gets past anything that only looks at what a person or a pattern matcher sees: a code review, a tool list in a UI, or a guardrail that matches keywords.
That matters most when something else registers tools on a page the site owner trusts, like a third-party script (#159). Tool names are already limited to ASCII, so they aren't affected, and a length limit (#73, #219) doesn't help, since a few hundred of these fit under any limit.
I work on a guardrail system myself, and the systems that run on ordinary machines with local models tend to depend on mechanical matching or on small models. That is because running a large model for both the agent and the guardrail makes inference too slow to use. Those are the systems where this is a real problem, since a small model or a matcher can be easier to confuse with text it can't see than a large one is. They should normalize text before they match on it, stripping or decoding these characters, and a host that shows a title or description to the user for approval shouldn't show something different from what it gives the model. So a short note for implementers would be enough. I'm not asking for a normative rule. Related: #11 and #313.
- 主要语言
- Bikeshed
- 星标
- 4.7k
- 派生
- 328
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 16
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
webmachinelearning/webmcp 的其他 Issue
-
Say how an agent should weigh annotations that the page wrote about itself可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
webmachinelearning/webmcp#353 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
webmachinelearning/webmcp#343 · 1 个 reaction ·
维护者通常 1 天内回复
-
Agenda+ i18n-tracker
难度 2/5 1-3 小时 新手友好度 75/100
webmachinelearning/webmcp#273 · 3 条评论 ·
维护者通常 1 天内回复
-
a11y-tracker Agenda+
难度 2/5 1-3 小时 新手友好度 67/100
webmachinelearning/webmcp#272 · 4 条评论 · 2 个 reaction ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 68/100
webmachinelearning/webmcp#234 · 5 条评论 ·
维护者通常 1 天内回复
查看 webmachinelearning/webmcp 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
cran-task-views/Survival#76 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
type:docs
难度 2/5 1-3 小时 新手友好度 76/100
sandtable-ai/sandtable#300 ·
维护者通常 1 天内回复
-
content good first issue
难度 2/5 1-3 小时 新手友好度 78/100