T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:70
- Finding
- Untrusted Supplier Content Is Processed by the Agent Without Prompt-Injection Controls## Vulnerability Details **File Location**: `SKILL.md:70-81`, `SKILL.md:95-114`, and `SKILL.md:122-136` **Vulnerability Type**: Indirect prompt injection through untrusted documents and case data **Risk Level**: Medium ### Vulnerable Instructions ```text #### Step 1: [Deterministic] Load + extract structured fields For each supplied document, extract: - Company legal name as written in that document. - Unified Social Credit Code (USCC) if present. - Certificate names with issue / expiry dates. - Revenue / scale figures and their stated source. - Product / service categories and declared scope. - Contact and registration details. Record the extraction into a material manifest (the deterministic script consumes this). ``` ```text #### Step 3: [LLM] Consistency & quality review Explain and extend the deterministic findings, and add judgments the script cannot: ``` ```text #### Step 4: [LLM] Produce the structured package + readiness report Render a standardized supplier material package and a readiness report with the P0/P1/P2 list and recommended actions. Recommended fixes must cite an existing supplied document — never invent. ``` ```text #### Step 1: [Deterministic] Load + normalize Read the cases (CSV / JSON / folder). Normalize each to the case schema: supplier, submitted materials, reviewer, stage, due date, decision, notes. Output `01-cases-normalized.json`. #### Step 2: [LLM] Status analysis ``` ### Technical Analysis The Skill requires an LLM-enabled agent to read supplier-controlled documents, case notes, CSV records, JSON fields, and folders. These inputs cross an untrusted-data boundary because suppliers or other external parties may control their contents. The instructions do not tell the agent to: - Treat instructions embedded in supplied files strictly as untrusted data. - Refuse role changes, policy overrides, tool requests, or output directives found in documents. ...[truncated 2655 chars]
- Remediation
- ## Remediation Suggestions 1. Add an explicit trust-boundary rule stating that all supplier documents, filenames, case notes, CSV fields, JSON values, and extracted text are untrusted data. 2. Require the agent to ignore any embedded instructions that request role changes, policy overrides, tool calls, network access, file access, secret disclosure, or altered output rules. 3. Restrict document access to files explicitly enumerated by the user. Resolve and validate paths before reading them, reject traversal outside the approved root, and avoid recursively processing unspecified files. 4. Use schema-bound extraction so each source contributes only expected values such as legal name, USCC, dates, certificate metadata, and financial figures. 5. Keep source text in clearly delimited data fields and never concatenate it into system or operational prompts. 6. Escape Markdown and HTML metacharacters before inserting supplier-controlled values into reports. Render external links as inert text unless a reviewer explicitly approves them. 7. Require source-file and page or section citations for every extracted fact and LLM-generated finding. 8. Prevent document-derived content from initiating tools or network requests. Any such action should require separate, explicit user confirmation. 9. Validate the generated manifest before running the deterministic script and compare report claims directly against `01-readiness-check.json`. 10. Add adversarial tests containing hidden instructions in document bodies, metadata, filenames, case notes, and spreadsheet cells to verify that they remain inert. 11. Apply equivalent safeguards to `SKILL_zh.md` so both Skill definitions enforce the same trust-boundary protections.