T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:76- Finding
Untrusted Input Is Embedded Directly into LLM Instruction Prompts
- Content
View full analysis
2000 else ""} ``` ``` ### Technical Analysis The skill inserts arbitrary source text directly into an instruction-bearing prompt using an f-string. The content is surrounded only by Markdown fences, which do not establish a security boundary for an LLM. An attacker can include another fence or instruction-like content in the source document and attempt to make the downstream model treat it as a higher-priority task. The same trust-boundary failure occurs in the evaluator prompt. Both `generator_output` and `original_text` are inserted without escaping or structural separation. Consequently, an attacker-controlled generator response or original document can attempt to influence the evaluator, force a passing score, suppress reported issues, or alter the expected JSON response. The reviewed code emits a workflow rather than directly invoking an LLM. Exploitation therefore depends on the surrounding OpenClaw runtime or another consumer subsequently executing the generated prompts. There is no evidence in the reviewed project that this issue grants operating-system command execution. ### Attack Path 1. An attacker supplies a document containing crafted prompt instructions, for example content that closes the Markdown fence and directs the model to ignore the digest task. 2. `build_generator_prompt()` inserts the content verbatim into the generated prompt. 3. The skill prints that prompt as part of the w ...[truncated 1075 chars]- Remediation
View remediation