T09 · Insecure Skill Coding Practices
- Location
scripts/responder.ts:141- Finding
Untrusted Social Platform Content Is Forwarded to an AI Agent Without Prompt-Injection Isolation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/responder.ts:141-159
Related Data Source:scripts/monitor.ts:247
Vulnerability Type: Indirect prompt injection through untrusted platform content
Risk Level: MediumVulnerable Code
ts const post = JSON.parse(line) as ScoredPost; inputCount++; if (isAlreadyReplied(post.id, log)) { console.error(`[responder] SKIP ${post.id}: already replied`); skipDup++; continue; } if (isAuthorCoolingDown(post.author, post.platform, log)) { console.error(`[responder] SKIP ${post.id}: author "${post.author}" cooldown (24h)`); skipAuthor++; continue; }The untrusted fields are subsequently included beside instructions intended for the Agent:
ts console.log(JSON.stringify({ action: 'review_draft', draft, post: { id: post.id, url: post.url, title: post.title, body: post.body.substring(0, 300), author: post.author, platform: post.platform, community: post.community, scores: post.scores, finalScore: post.finalScore, }, instructions: `Generate a value-first reply for this ${post.platform} post. Follow the template at templates/reply-${post.platform}.md. Brand mention ≤20%. Then present the draft to the user for approval.`, }));The monitor emits platform-supplied post data without a security transformation:
ts console.log(JSON.stringify(post));Technical Analysis
Post titles, bodies, author names, community names, and related fields originate from external social platforms and can therefore be controlled by arbitrary platform users. The monitor serializes these fields without distinguishing data from instructions. The responder then places the fields in the same Agent task as its operational instructions.
An attacker can publish content containing instructions such as requests to disregard the reply-generation task, reveal contextual ...[truncated 2147 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly identify every platform-derived field as untrusted data that must never be interpreted as an instruction.
- Use strict role separation in the downstream Agent prompt. Place platform content in a clearly delimited data block and state that instructions within that block must be ignored.
- Pass only fields necessary for reply generation and remove metadata that the Agent does not need.
- Add normalization and validation for platform identifiers before interpolating them into template paths.
- Detect common prompt-injection patterns and flag affected posts for manual inspection rather than automatic Agent processing.
- Run draft generation with no external tools and no access to credentials, local memory, or unrelated conversation context.
- Require the generated output to conform to a strict schema and validate it before displaying or posting it.
- Preserve manual approval and ensure approval is bound to the exact final text and destination that will be sent.
- Add regression tests using malicious titles and bodies to verify that embedded instructions cannot alter the generation policy.