T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/content_analyzer.py:205
- Finding
- Indirect Prompt Injection Through Untrusted Reviewed Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/content_analyzer.py`, lines 205–228 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```python def extract_plot_and_characters(text: str) -> Optional[dict]: """Let the AI extract structured plot points and character summaries.""" # Truncate excessively long text truncated = text[:5000] prompt = ( f"Analyze the following text and extract structured information:\n\n" f"{truncated}\n\n" f"Reply in JSON format:\n" f'{{"plot_points": [{{"index": 1, "summary": "plot summary", ' f'"characters": ["character name"], "importance": "core|normal|minor"}}], ' f'"characters": [{{"name": "character name", "traits": ["trait"], ' f'"relationships": {{"character name": "relationship"}}}}]}}' ) system = "You are a literary analysis expert specializing in narrative structure and character extraction." result = call_ai(prompt, system) if result: try: json_match = result[result.find("{"):result.rfind("}") + 1] return json.loads(json_match) except (json.JSONDecodeError, ValueError): return {"raw_analysis": result} return None ``` The same interpolation pattern is used for suspicious copyright passages, age-rating context, adaptation deviations, and aggregated findings in `scripts/content_analyzer.py`. ### Technical Analysis The reviewed script is untrusted input, but it is inserted directly into an instruction-bearing user prompt. There is no strong separation between control instructions and the content being analyzed. The system prompt also does not explicitly require the provider model to treat all embedded instructions as inert data. A malicious script can therefore include instructions such as directing the model to ignore the requested analysis and return attacker-selected JSON. The implementation then extract ...[truncated 1452 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Place reviewed content inside an unambiguous data envelope and state in the system prompt that instructions found inside that envelope must never be followed. 2. Prefer structured API input or tool/function calling where supported, rather than asking the model to produce arbitrary JSON in free-form text. 3. Validate responses with a strict schema: - Reject unknown fields. - Enforce expected field types. - Restrict classification values to documented enumerations. - Limit string and array sizes. 4. Do not accept arbitrary text as a successful fallback when JSON parsing fails. 5. Treat downstream model output as untrusted before rendering it into reports or passing it to another Agent. 6. Add adversarial tests containing instruction-like script text, malformed JSON, multiple JSON objects, oversized values, and unexpected fields. 7. Preserve local algorithmic results as authoritative evidence and use AI output only as a clearly identified, non-binding supplemental assessment. ]]>