T09 · Insecure Skill Coding Practices
- Location
search_dorks_skill/models.py:94- Finding
Untrusted Search Results Are Embedded Directly into LLM Context
- Content
View full analysis
Vulnerability Details
File Location:
search_dorks_skill/models.py:94-119
Vulnerability Type: Indirect prompt injection through untrusted search content
Risk Level: MediumVulnerable Code
python def to_context(self, max_results: int = 20) -> str: """Format results for LLM context window.""" lines = [ f"=== Search Report ===", f"Query: {self.query}", f"Intent: {self.intent.category.value}/{self.intent.subcategory}", f"Strategy: {self.strategy.name}", f"Results: {len(self.results)} (of {self.total_found} total)", f"Engines: {', '.join(self.engines_used)}", f"Time: {self.timing_seconds:.2f}s", "", ] for i, r in enumerate(self.results[:max_results], 1): lines.append(f"[{i}] {r.title}") lines.append(f" URL: {r.url}") lines.append(f" {r.snippet[:300]}") lines.append(f" Score: {r.relevance:.2f} | Engines: {', '.join(r.engines)}") lines.append("") if self.suggestions: lines.append("Suggested refinements:") for s in self.suggestions[:5]: lines.append(f" • {s}") return "\n".join(lines)Technical Analysis
The
to_context()method is explicitly intended to create text for insertion into an AI agent's context. It includes search-result titles, URLs, snippets, and suggestions without establishing a trust boundary or identifying these values as untrusted external data.These fields originate from the SearXNG response and are copied into
SearchResultobjects bysearch_dorks_skill/client.py. A search result can therefore contain text designed to resemble system, developer, or tool instructions. Truncating a snippet to 300 characters limits its size but does not neutralize instruction-like content.No command-execution sink exists in this package, so the injected text is not executed locally by the Python cod ...[truncated 1602 chars]
- Remediation
View remediation
Remediation Suggestions
- Return search results as structured data rather than concatenating them directly with trusted agent instructions.
- Clearly label all titles, URLs, snippets, and suggestions as untrusted external content.
- Wrap each field in explicit delimiters and include a trusted instruction outside those delimiters stating that content inside them must never be followed as instructions.
- Keep tool-control instructions in a higher-priority system or developer message rather than in the same text block as search data.
- Validate response types and impose conservative length limits on every external field.
- Normalize control characters and formatting that could blur boundaries between separate results or trusted instructions.
- Add defense-in-depth detection for common prompt-injection phrases. Detection should flag or annotate suspicious results rather than being treated as a complete security boundary.
- Require confirmation before a host agent performs sensitive actions based on search results.
- Restrict consuming agents to least-privilege tools and enforce destination, operation, and argument allowlists independently of model output.
- Add tests using malicious titles and snippets to verify that result content remains data and cannot alter tool-selection policy.