T09 · Insecure Skill Coding Practices
Warning
- Location
- prompts/03-reputation-referral.md:31
- Finding
- Selective Review Solicitation Enables Review Gating<![CDATA[ ## Vulnerability Details **File Location**: `prompts/03-reputation-referral.md`, lines 31–33 and 48–52 **Vulnerability Type**: Review gating caused by contradictory prompt logic **Risk Level**: Medium ### Vulnerable Code ```text - Review requests must not suppress negative reviews (routing unhappy customers away from public review) - Compliant language: "If you were satisfied with our service, an honest Google review helps other homeowners find reliable chimney professionals — we appreciate whatever you're willing to share" - Satisfaction check gate: sequence must include a genuine satisfaction check BEFORE the public review ask — prevents capturing complaints publicly while harvesting only positive reviews (FTC enforcement risk) ``` ```text TOUCH 1 — Text message (same day, within 2 hours of job completion): - Satisfaction check: "Hi [Customer name], this is [TECHNICIAN_NAME] from [BUSINESS_NAME] — how did everything go today? Any concerns I can address before I leave the area?" - If positive response → Touch 2 (review ask) - If negative or no response → internal alert only; no public review push - 50–75 words ``` ### Technical Analysis The prompt claims that negative reviews must not be suppressed, but its operational instructions condition access to the public review request on a positive satisfaction response. Customers who respond negatively—or do not respond—are explicitly excluded from receiving the public review link. This is review gating: feedback sentiment determines whether a customer is invited to publish a public review. The phrase “harvesting only positive reviews” further demonstrates that the filtering is intentional rather than incidental. Although this issue does not provide operating-system access or code execution, it is an insecure Skill design because the generated workflow can systematically manipulate public reputation data and contradict the stated compliance controls. ### Attack Path 1. A contractor supplies custome ...[truncated 1017 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Send the same neutral public-review invitation to every customer, regardless of satisfaction, response sentiment, or lack of response. 2. Use the satisfaction check only to identify and resolve support issues; do not use it as an eligibility gate for the review link. 3. Replace the conditional instructions with logic such as: ```text - Send the same neutral review invitation to all customers. - If a customer reports a concern, create an internal support alert and address the concern promptly. - Do not delay, suppress, or remove the customer's opportunity to submit an honest public review. ``` 4. Remove the phrase “harvesting only positive reviews.” 5. Add an output-validation rule requiring the model to reject any generated sequence that sends review links only to customers with positive sentiment. 6. Test the prompt with positive, negative, neutral, and absent customer responses to verify that all customers retain equal access to the public review channel. ]]>