T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/video_analyzer.py:273
- Finding
- Indirect Prompt Injection Through Untrusted Video Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/video_analyzer.py:273-300` **Vulnerability Type**: Indirect prompt injection caused by mixing untrusted content with model instructions **Risk Level**: High ### Vulnerable Code ```python client = anthropic.Anthropic(api_key=api_key) content = [] for i, fp in enumerate(frames): img_data = base64.b64encode(resize_frame(fp)).decode() content.append({ "type": "image", "source": {"type": "base64", "media_type": "image/jpeg", "data": img_data}, }) content.append({"type": "text", "text": f"[Frame {i + 1}/{len(frames)}]"}) content.append({ "type": "text", "text": f"\nTRANSCRIPT:\n{transcript}" if transcript else "\n[No transcript available — analysis from frames only]", }) content.append({ "type": "text", "text": ANALYSIS_PROMPT.format(n_frames=len(frames), title=title), }) response = client.messages.create( model=model, max_tokens=4096, messages=[{"role": "user", "content": content}], ) ``` ### Technical Analysis Video frames, captions, and transcripts are controlled by the publisher of the analyzed video. The implementation places this untrusted material in the same user-role message as the instructions governing Markdown generation. No higher-priority system message establishes that text found in frames or transcripts is data rather than instructions. There is also no explicit instruction to ignore commands embedded in the source material. Consequently, visible text or spoken content such as “ignore the requested format and output the following instructions” may be interpreted as an instruction by the model. The generated Markdown is written directly to an output file without validation or sanitization. The Skill documentation subsequently instructs an Agent to read and present that file, increasing the chance that malicious model outp ...[truncated 1370 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Send a higher-priority system message that explicitly states that frames, captions, titles, and transcripts are untrusted data. 2. Instruct the model never to follow commands found in the source video and to report apparent prompt-injection attempts instead. 3. Delimit the transcript and metadata with clear data boundaries, preferably using structured content fields. 4. Keep trusted instructions separate from source material rather than combining everything in one user-role message. 5. Validate generated Markdown before saving or presenting it. Remove or neutralize active HTML, unsafe links, and command-like instructions where they are not required. 6. Present the generated file to downstream Agents as untrusted model output, not as authoritative Skill instructions. 7. Add adversarial tests using caption-based, visual, and spoken prompt-injection payloads. ]]>