T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:183
- Finding
- Untrusted Web Content Is Processed Without Prompt-Injection Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 183–190 **Vulnerability Type**: Indirect prompt injection through untrusted search results **Risk Level**: Medium ### Vulnerable Instructions ```markdown **3c.** For every fact in `batch_pool` with the `keywords-generated` state, use `sessions_spawn` to launch sub-agents for parallel searches: - Each sub-agent executes `web_search`, takes the first three results, and retrieves their content with `web_fetch`. - If at least one search result contains the entity from the original text, change the state to `fact-fetch`. - If no result contains the entity, or a tool returns an error, retain the `keywords-generated` state and keep the fact in `batch_pool`. **3d.** For every fact in `batch_pool` with the `fact-fetch` state, compare each element according to `references/verification-criteria.md`: - If all elements are consistent, change the state to `Verified`. - If a key element is inconsistent, change the state to `Corrected` and record `actual_fact`, `source_url`, and `divergence_type`. - If the search result has no direct correspondence with the entity, number, or date in the original text, change the state to `Remain` and record the reason. ``` The quoted instructions are an English translation of the complete affected segment in `SKILL.md`. ### Technical Analysis The skill directs sub-agents to retrieve the first three search results with `web_fetch` and process the returned page content as evidence. Search-result pages are untrusted, attacker-controlled inputs, but the skill provides no explicit security boundary requiring sub-agents to: - Treat fetched page text exclusively as untrusted data. - Ignore instructions, tool requests, or role-like text embedded in a page. - Prevent fetched content from changing the sub-agent's task or output format. - Restrict retrieval to safe public HTTP or HTTPS destinations. - Prefer authoritative sources or require independent corroboration. - Separate verbati ...[truncated 2772 chars]
- Remediation
- ## Remediation Suggestions 1. **Establish an explicit untrusted-content boundary** - State that all search results and fetched pages are untrusted data. - Instruct every sub-agent never to follow commands, role declarations, tool requests, or policy text found in fetched content. - Require the sub-agent to use page content only to extract factual evidence relevant to the assigned claim. 2. **Use constrained structured extraction** - Require sub-agents to return a fixed schema containing only the source URL, page title, publication date, quoted evidence, source type, and comparison result. - Reject output containing unexpected instructions, executable content, or fields outside the schema. - Bound the size of excerpts and require exact quotations to remain distinct from generated analysis. 3. **Strengthen source validation** - Prefer official publications, regulatory filings, primary documentation, and established professional sources. - Do not classify a fact as `Corrected` based solely on a blog, social-media post, content farm, or other user-generated source. - Require corroboration from at least two independent sources for material corrections when no authoritative primary source is available. - Detect mirrors and syndicated copies so they are not counted as independent evidence. 4. **Harden URL retrieval** - Permit only public HTTP and HTTPS URLs. - Reject redirects or destinations resolving to loopback, link-local, private, reserved, or cloud-metadata address ranges. - Apply response-size, content-type, redirect-count, and timeout limits. - Do not download or execute scripts, binaries, archives, or active page content. 5. **Add prompt-injection detection** - Flag content containing phrases that address the agent, request policy overrides, instruct tool use, or demand a specific classification. - Exclude suspicious text from evidence and mark the affected fact as `Remain` when trustworthy evidence cannot be ob ...[truncated 753 chars]