T09 · Insecure Skill Coding Practices
Warning
- Location
agents/classifier_agent.py:44- Finding
Indirect Prompt Injection Through Untrusted Paper Content
- Content
View full analysis
str: """Return the category name for a single paper.""" user_input = ( f"Please classify the following paper:\n\n" f"**Title**: {title}\n\n" f"**Abstract**: {abstract}" ) try: result = self.chain.invoke( {"messages": [{"role": "user", "content": user_input}]} ) ``` The original prompt text is written in Chinese, but the data flow shown above is equivalent: attacker-controlled `title` and `abstract` values are directly interpolated into an LLM message. `agents/reader_agent.py:60-96`: ```python title = paper_info["title"] authors = ", ".join(paper_info.get("authors", [])) arxiv_id = paper_info["arxiv_id"] # Pass 1 logger.info(f" [Pass 1] {title[:60]}...") first_pass_text = truncate_text(parsed_paper.first_pass_text, 30000) user_msg_1 = FIRST_PASS_USER.format( title=title, authors=authors, arxiv_id=arxiv_id, first_pass_content=first_pass_text, ) result_1 = self.chain.invoke( {"messages": [{"role": "user", "content": user_msg_1}]} ) initial_summary = result_1["messages"][-1].content # Pass 2 logger.info(f" [Pass 2] {title[:60]}...") main_body = truncate_text(parsed_paper.main_body_text, 50000) if not main_body.strip(): return self._format_final_notes(paper_info, initial_summary) user_msg_2 = SECOND_PASS_USER.format( initial_summary=initial_summary, main_body=main_body, ) result_2 = self.chain.invoke( {"messages": [{"role": "user", "content": user_msg_2}]} ) ...[truncated 4388 chars]- Remediation
View remediation