T09 · Insecure Skill Coding Practices
- Location
SKILL.md:27- Finding
Untrusted Email Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 27–32, 55–64, and 200–207
Vulnerability Type: Indirect prompt injection through attacker-controlled email content
Risk Level: MediumVulnerable Code Snippets
markdown ### Step 1: Fetch Emails Use the Gmail skill (Maton API) to fetch emails from romain@arcascience.ai. - For "check my emails" → fetch last 10-20 unread or recent - For "emails from today" → fetch last 24 hours - For "reply to X" → fetch the specific thread - For daily cron → fetch last 24 hours, all emails Read the FULL content of each email (not just subject/snippet).markdown **B. Check if sender is from a known pharma company:** - Look up `arcascience_dossiers/companies/` for company dossier - Look up `arcascience_dossiers/stakeholders/` for contact profile - Check `arcascience_dossiers/master_targeting_table.csv` for targeting data - If found: extract strategic entry angle, key challenges, therapeutic focus, buying pathway **C. If sender is unknown external:** - Infer company and role from email signature/domain - Search web if needed for company context - Draft a professional but measured responsemarkdown ### Step 7: Send (ONLY on explicit confirmation) **CRITICAL: NEVER send an email without Romain saying "envoyer X" or "send X" explicitly.** When confirmed: 1. Send via Gmail skill with attachment(s) if specified 2. Confirm delivery and list of PJ sent 3. Log the sent emailTechnical Analysis
The Skill requires the agent to read complete email bodies, including signatures and quoted thread content. These inputs are controlled by external senders, but the Skill does not establish a trust boundary requiring them to be treated solely as data. It does not direct the agent to ignore commands, tool requests, alleged policy messages, or file-access instructions embedded in an email.
This creates an indirect prompt-injection weakness. An attacker can place natural-language instructions in a ...[truncated 2734 chars]
- Remediation
View remediation
Remediation Suggestions
-
Define a strict trust boundary for message content. Add an explicit rule stating that email bodies, subjects, signatures, quoted threads, attachments, and linked pages are untrusted data and never authoritative agent instructions.
-
Prohibit instruction following from retrieved content. Require the agent to ignore requests inside emails that ask it to use tools, reveal data, change policy, access files, contact third parties, or alter the workflow.
-
Bind tool use to authenticated user intent. Gmail operations, local-file reads, web searches, and attachment selection should be authorized only by the user’s request and the Skill’s fixed policy—not by retrieved content.
-
Apply least privilege to local files. Use an allowlist of approved sales assets and task-relevant dossiers. Prevent arbitrary path selection based on email text, and prohibit access to unrelated files.
-
Separate extraction from action planning. First parse each message into inert structured fields such as sender, subject, questions, and requested business action. Generate plans only from those fields after removing or flagging agent-directed language.
-
Add injection detection and escalation. Flag messages containing phrases that address an assistant, request policy overrides, ask for secrets, specify local paths, or demand tool execution. Such messages should require manual review before any lookup or draft is produced.
-
Strengthen outbound confirmation. Before sending, display the exact recipient addresses, full body, attachment filenames and canonical paths, data classification, and reason each attachment was selected. Require fresh confirmation after every modification.
-
Prevent automatic sensitive attachment selection. Require separate explicit approval for contracts, confidentiality agreements, client-specific proposals, internal documents, and any file containing personal or confidential information.
-
**Constrai ...[truncated 680 chars]
-