T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:183- Finding
Untrusted Web Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 183–190
Vulnerability Type: Indirect prompt injection through untrusted search results
Risk Level: MediumVulnerable Instructions
markdown **3c.** For every fact in `batch_pool` with the `keywords-generated` state, use `sessions_spawn` to launch sub-agents for parallel searches: - Each sub-agent executes `web_search`, takes the first three results, and retrieves their content with `web_fetch`. - If at least one search result contains the entity from the original text, change the state to `fact-fetch`. - If no result contains the entity, or a tool returns an error, retain the `keywords-generated` state and keep the fact in `batch_pool`. **3d.** For every fact in `batch_pool` with the `fact-fetch` state, compare each element according to `references/verification-criteria.md`: - If all elements are consistent, change the state to `Verified`. - If a key element is inconsistent, change the state to `Corrected` and record `actual_fact`, `source_url`, and `divergence_type`. - If the search result has no direct correspondence with the entity, number, or date in the original text, change the state to `Remain` and record the reason.The quoted instructions are an English translation of the complete affected segment in
SKILL.md.Technical Analysis
The skill directs sub-agents to retrieve the first three search results with
web_fetchand process the returned page content as evidence. Search-result pages are untrusted, attacker-controlled inputs, but the skill provides no explicit security boundary requiring sub-agents to:- Treat fetched page text exclusively as untrusted data.
- Ignore instructions, tool requests, or role-like text embedded in a page.
- Prevent fetched content from changing the sub-agent's task or output format.
- Restrict retrieval to safe public HTTP or HTTPS destinations.
- Prefer authoritative sources or require independent corroboration.
- Separate verbati ...[truncated 2772 chars]
- Remediation
View remediation
Remediation Suggestions
-
Establish an explicit untrusted-content boundary
- State that all search results and fetched pages are untrusted data.
- Instruct every sub-agent never to follow commands, role declarations, tool requests, or policy text found in fetched content.
- Require the sub-agent to use page content only to extract factual evidence relevant to the assigned claim.
-
Use constrained structured extraction
- Require sub-agents to return a fixed schema containing only the source URL, page title, publication date, quoted evidence, source type, and comparison result.
- Reject output containing unexpected instructions, executable content, or fields outside the schema.
- Bound the size of excerpts and require exact quotations to remain distinct from generated analysis.
-
Strengthen source validation
- Prefer official publications, regulatory filings, primary documentation, and established professional sources.
- Do not classify a fact as
Correctedbased solely on a blog, social-media post, content farm, or other user-generated source. - Require corroboration from at least two independent sources for material corrections when no authoritative primary source is available.
- Detect mirrors and syndicated copies so they are not counted as independent evidence.
-
Harden URL retrieval
- Permit only public HTTP and HTTPS URLs.
- Reject redirects or destinations resolving to loopback, link-local, private, reserved, or cloud-metadata address ranges.
- Apply response-size, content-type, redirect-count, and timeout limits.
- Do not download or execute scripts, binaries, archives, or active page content.
-
Add prompt-injection detection
- Flag content containing phrases that address the agent, request policy overrides, instruct tool use, or demand a specific classification.
- Exclude suspicious text from evidence and mark the affected fact as
Remainwhen trustworthy evidence cannot be ob ...[truncated 753 chars]
-