T09 · Insecure Skill Coding Practices
Error
- Location
- sanitize_core.py:481
- Finding
- Detected prompt-injection instructions remain in sanitized LLM output<![CDATA[ ## Vulnerability Details **File Location**: `sanitize_core.py:481-583`; `sanitizer.py:70-123` **Vulnerability Type**: Prompt-injection content retained across the sanitization boundary **Risk Level**: High ### Vulnerable Code ```python # sanitize_core.py # 9. Detect injection patterns on CLEAN text (this is the correct order) flags = list(pre_flags) # start with pre-strip findings flags.extend(detect_injection_patterns(text)) # Also detect on normalized (fuzzy) version normalized = normalize_for_detection(text) if normalized != text: flags.extend(detect_injection_patterns(normalized, spaceless=True)) # Spaceless detection: strip all non-alpha and check spaceless = re.sub(r'[^a-zA-Z]', '', text) flags.extend(detect_injection_patterns(spaceless, spaceless=True)) # Add structural flags flags.extend(md_flags) if hyperlink_flag: flags.append("markdown_hyperlink_detected") if ref_link_flag: flags.append("reference_link_detected") if url_flag: flags.append("bare_url_detected") if code_flag: flags.append("code_block_detected") if b64_flag: flags.append("base64_blob_detected") if hex_flag: flags.append("hex_string_detected") if data_flag: flags.append("data_uri_detected") if MULTI_BLANK_LINES_RE.search(raw_text): flags.append("hidden_text_indicator: multiple blank lines") # Unicode anomalies in raw text invisible_count = sum(1 for ch in raw_text if ch in INVISIBLE_CHARS) if invisible_count > 5: flags.append("unicode_anomaly: invisible characters detected") if VARIATION_SELECTOR_RE.search(raw_text): flags.append("unicode_anomaly: variation selectors") if TAG_CHAR_RE.search(raw_text): flags.append("unicode_anomaly: tag characters") # 10. Deduplicate flags (preserving order) flags = list(dict.fromkeys(flags)) # 11. Truncate text = truncate(text, max_len) return text, flags, original_length ``` ```python # sanitizer.py # Sanitize body (full pipeline) body_clean, body_flags, original_length = sanitize_text ...[truncated 3945 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not return detected injection text in any field intended for an LLM context. 2. If injection flags are present, replace the subject, body, description, title, and location with fixed placeholders such as `[content quarantined due to prompt injection]`. 3. Return quarantined content only through a separate interface that is never included in model input. 4. Apply quarantine regardless of sender tier. Sender reputation must not override content-based detection. 5. Make safe behavior the sanitizer’s default rather than relying on every caller to enforce `suspicious`. 6. Consider a structured result with separate `safe_metadata` and `quarantined_content_reference` fields. 7. Update integration examples so suspicious records are excluded before any object is appended to agent context. 8. Add regression tests asserting that known injection phrases are absent from every LLM-facing output field for both known and unknown senders. 9. Apply equivalent quarantine behavior to suspicious calendar titles, descriptions, locations, organizer names, and conference descriptions. 10. Document that regex detection is defense-in-depth and that downstream agents must still use least-privilege tool policies. ]]>