T09 · Insecure Skill Coding Practices
- Location
scripts/prompt_builder.py:221- Finding
Untrusted Material Content Is Inserted Directly into AI Prompts
- Content
View full analysis
Vulnerability Details
File Location:
scripts/prompt_builder.py:221-229
Vulnerability Type: Indirect prompt injection through imported reference material
Risk Level: MediumVulnerable Code
python for fname, content in materials: # Truncate long content to reasonable reference size excerpt = content[:2000] if len(content) > 2000: excerpt += '\n\n...（内容已截断，完整内容见素材库）' lines.append(f"### 参考：{fname}") lines.append(excerpt) lines.append('')Technical Analysis
The prompt builder reads material-library files and concatenates their content directly into the operative AI prompt. Although content is truncated to 2,000 characters, it is not escaped, classified as untrusted data, or enclosed within a security boundary that instructs the model not to execute embedded directives.
Material files can originate from user-selected imports under the workflow documented in
SKILL.md. An attacker-controlled file can therefore include instructions such as requests to disregard the proposal-writing task, reveal surrounding prompt context, fabricate claims, or append unrelated content. When a matching chapter is generated, those instructions become part of the model prompt and may compete with legitimate writing directives.This is an insecure prompt-construction practice rather than evidence that the bundled material is itself malicious. No malicious prompt-injection instructions were identified in the currently included material files.
Attack Path
- An attacker supplies a crafted Markdown or text document presented as legitimate proposal reference material.
- The user imports that document into a searched material-library directory such as
chapter-examplesorpast-projects. - The attacker selects a filename sufficiently similar to a target chapter so that
find_material_references()matches it. - The function reads the file without validating its semantic ...[truncated 961 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat every imported material file as untrusted data, regardless of its source or filename.
- Enclose reference content in explicit delimiters and place an instruction immediately before and after it stating that embedded commands are data and must not be followed.
- Separate trusted writing instructions from untrusted reference content using distinct structured fields or model-message roles where the AI integration supports them.
- Detect and quarantine common instruction-hijacking patterns, including requests to ignore previous instructions, reveal prompts, change roles, invoke tools, or append unrelated content.
- Require user confirmation before using newly imported material and display its filename, origin, and detected risk indicators.
- Preserve source provenance so generated claims can be traced back to the tender document or an approved internal source.
- Add adversarial tests containing malicious instructions in matched material files and verify that those instructions are quoted or ignored.
- Do not rely on the existing 2,000-character truncation as a security control; a complete malicious instruction can fit well within that limit.