T09 · Insecure Skill Coding Practices
Warning
- Location
references/social-analytics.md:131- Finding
Untrusted Social Media Comments Are Sent to an External LLM Without Sanitization or Prompt-Injection Controls
- Content
View full analysis
dict: prompt = f"""Analyze these social media comments and classify each as: - positive, neutral, or negative - category: product_feedback, shipping, price, comparison, question, praise, complaint - urgency: high (requires response), medium, low Comments: {comments} Return JSON: [{{"comment": "...", "sentiment": "...", "category": "...", "urgency": "..."}}]""" response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1000, messages=[{"role": "user", "content": prompt}] ) return response.content[0].text ``` ### Technical Analysis The function directly interpolates externally controlled social media comments into an instruction-bearing prompt. No separation, escaping, sanitization, or explicit treatment of the comments as untrusted data is applied. An attacker can publish a comment containing instructions such as requests to ignore the classification task, generate forged classifications, or return content that violates the expected output structure. Because the implementation returns the model's response as an unrestricted string rather than validating it against a schema, manipulated output can propagate into dashboards, moderation workflows, or automated response systems. The comments are also transmitted to Anthropic over the network. Social media comments may contain usernames, email addresses, telephone numbers, account identifiers, or other personal data. The example provides no redaction, consent verification, data-minimization step, retention control, or regional-processing configuration before this disclosure. ...[truncated 1985 chars]- Remediation
View remediation
Classification: bounded_comment = redacted_comment[:2000] prompt = { "task": "Classify the supplied comment.", "se ...[truncated 981 chars]