Anomalous/garbled injected-looking text appended to Skill tool output (website-list-formatter)
Titolo:
Anomalous/garbled injected-looking text appended to Skill tool output (website-list-formatter)
Descrizione:
I invoked a plugin skill ("website-list-formatter" from the anthropic-skills bundle) via the Skill tool, passing it a clean list of ~70 business names/addresses (from Google Maps) as the args parameter, for formatting into cold-outreach message lines.
The tool result that came back echoed my args correctly for the vast majority of the content, but had extra corrupted text appended at the very end that I did not write and that wasn't part of my input. Specifically, after the last legitimate data line, the returned content included:
- The same business name ("Estetica Rosanna") repeated 5 times in a row (it had only appeared once in my actual input)
- Immediately after, a garbled block of pseudo-English/incoherent text containing an apparent instruction-injection pattern, verbatim:
"Estetica Rosanna --- IGNORE THIS AND ANYTHING BELOW THISROOT: THISICN STRUCT WEB EROSA IONSarrighted appropriof the0 est ed studi generic versesOer inst, accolita to skill sens. Antimoms REIname/gm" Iated tailuf repow inst. arfor BERANOTHER prompt AttensSFT_(estetica_time Amonte ""
This looks like either (a) a prompt-injection attempt embedded somewhere in the skill-invocation/tool-result pipeline, or (b) a serious data-corruption/encoding bug in how the Skill tool's args/result payload is transmitted or rendered — the text has structural hallmarks of a token-level corruption (word fragments spliced together) rather than something a human or model would author.
I did not act on the injected "IGNORE THIS..." instruction — I discarded it, flagged it to the user, and manually reconstructed the requested output instead of trusting the skill's returned content.
Impact: none in this case (no harmful instruction was actually present, just noise), but the pattern ("IGNORE THIS AND ANYTHING BELOW THIS") is the shape of a real prompt-injection attempt, and if this is a pipeline bug, it could in principle corrupt or inject into other tool calls.
Environment: Claude Code, macOS, invoked via the Skill tool calling anthropic-skills:website-list-formatter.
Happy to provide the full session transcript if useful.