T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:18
- Finding
- Prompt Injection Through Untrusted Translation Content## Vulnerability Details **File Location**: `index.js:18-29` **Vulnerability Type**: Untrusted input directly interpolated into an instruction-bearing Agent prompt **Risk Level**: Medium ### Vulnerable Code ```js async run({ content, format = "script" }, { agent }) { let instruction = ""; if (format === "roman") { instruction = "Translate the following into Roman Urdu (Urdu written in English alphabets like 'Kaise ho?'):"; } else { instruction = "Translate the following into Pure Urdu Script (Urdu written in its native characters):"; } const response = await agent.chat(`${instruction}\n\n"${content}"`); return response; } ``` ### Technical Analysis The attacker-controlled `content` parameter is directly concatenated with the translation instruction and submitted to `agent.chat`. Quotation marks do not establish a trusted security boundary for a language model. An attacker can include closing quotation marks, prompt delimiters, or instruction-like text that attempts to override the intended translation operation. The implementation does not use structured message roles to separate trusted instructions from untrusted content. It also does not instruct the Agent to treat the supplied content exclusively as text to translate. Consequently, the model may interpret embedded instructions as part of its active task rather than as inert source material. ### Attack Path 1. An attacker invokes the skill with malicious instructions embedded in the `content` parameter. 2. The skill interpolates that content directly into the same prompt containing the trusted translation instruction. 3. The combined prompt is passed to `agent.chat`. 4. The model may follow the embedded instructions instead of translating the content. 5. Depending on the capabilities exposed through the host Agent, this may manipulate the response or induce other unintended Agent behavior. For example, an attacker could provide content conceptually resembling: ```text ...[truncated 923 chars]
- Remediation
- ## Remediation Suggestions 1. Use a structured chat API with separate roles so the translation policy is placed in a trusted system or developer message and the source text is supplied as untrusted user data. 2. Explicitly instruct the model that all text inside the translation payload is data to translate and that instructions contained within it must never be followed. 3. If supported, pass the source text through a dedicated structured field rather than interpolating it into an instruction string. 4. Apply strict input length limits to reduce denial-of-service risk and constrain excessively large adversarial prompts. 5. Do not grant the translation Agent access to unrelated tools, secrets, files, or system operations. Enforce least privilege so that prompt injection cannot escalate beyond incorrect translation output. 6. Add adversarial tests covering embedded instructions, quotation termination, role-like delimiters, and requests to ignore prior instructions. 7. If structured roles are unavailable, use clearly defined randomized or escaped delimiters and reiterate that delimited content is inert translation material. This is defense in depth and is weaker than genuine role separation.