T09 · Insecure Skill Coding Practices
- Location
scripts/analyze_repo.sh:56- Finding
Unsanitized Remote Repository Content Embedded in Generated Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyze_repo.sh, lines 56–62 and 271–283
Vulnerability Type: Markdown content injection and potential indirect prompt injection
Risk Level: MediumVulnerable Code
bash README_URL="https://raw.githubusercontent.com/${REPO}/main/README.md" README_CONTENT=$(curl -sL "$README_URL" 2>/dev/null) if [ -z "$README_CONTENT" ]; then README_URL="https://raw.githubusercontent.com/${REPO}/master/README.md" README_CONTENT=$(curl -sL "$README_URL" 2>/dev/null) fi README_FIRST_LINES=$(echo "$README_CONTENT" | head -50)The remotely supplied content is subsequently written directly into the report:
bash cat >> "$REPORT_FILE" << EOF --- ## 📖 README 摘要 (前 50 行) \`\`\`markdown $README_FIRST_LINES \`\`\` --- *报告由 github-analyzer 技能自动生成* EOFTechnical Analysis
The script retrieves a README from a repository selected by the user and embeds its first 50 lines verbatim in a generated Markdown report. The README is attacker-controlled input, but it is not escaped or sanitized before interpolation into the here-document.
An attacker can include a closing Markdown fence in the README and thereby terminate the report's intended code block. Subsequent attacker-controlled content may then be rendered as active Markdown or HTML, including deceptive headings, links, images, or instructions. Repository metadata such as the description is also interpolated into the report without Markdown escaping, although the README inclusion provides the clearest injection path.
This script does not itself execute the injected text as shell commands. However, if the report is later opened in a Markdown renderer, its visual integrity can be compromised. If an AI agent processes the report, attacker-supplied instructions may also act as indirect prompt injection unless that agent treats report excerpts as untrusted data.
Attack Path
- An at ...[truncated 1407 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all GitHub API fields and downloaded repository files as untrusted input.
- Do not place untrusted content inside a fixed-length Markdown fence. Select a fence longer than the longest consecutive backtick or tilde sequence present in the input.
- Alternatively, prefix every README line with indentation and escape Markdown or HTML metacharacters before writing the report.
- Sanitize other remote fields, including repository name, description, language, URLs, and license identifiers, before interpolating them into Markdown tables or links.
- Add explicit labels around repository excerpts stating that they are untrusted data and must not be interpreted as operational instructions.
- Ensure downstream AI systems use a trust boundary that prevents instructions found in repository content or generated reports from overriding system or user instructions.
- Add regression tests using README content containing backtick fences, tilde fences, HTML, misleading links, and prompt-injection text, and verify that all such input remains visibly contained within the excerpt.