T09 · Insecure Skill Coding Practices
Warning
- Location
- fetch_ai_news_improved.py:153
- Finding
- Untrusted RSS Content Is Rendered as Agent-Facing Markdown Without Neutralization## Vulnerability Details **File Location**: `fetch_ai_news_improved.py`, lines 153-155 and 217-221 **Vulnerability Type**: Indirect prompt injection and unsafe Markdown generation **Risk Level**: Medium ### Vulnerable Code ```python title = entry.get("title", "无标题") link = entry.get("link", "") summary = entry.get("summary", entry.get("description", "")) ``` ```python lines.append(f"**{trans['title']}**") if trans["summary"]: lines.append(f"> {trans['summary'][:200]}") if orig["link"]: lines.append(f"🔗 [原文链接]({orig['link']})") ``` ### Technical Analysis Article titles, summaries, and links originate from external RSS feeds. These values are incorporated into the generated Markdown without escaping Markdown control characters or validating URL schemes. Although HTML tags are removed from summaries elsewhere in the script, HTML removal does not neutralize Markdown syntax, instruction-like text, embedded links, or malformed link destinations. Titles and summaries are also sent through translation, but translation is not a security boundary and may preserve attacker-controlled instructions and formatting. The generated digest is written to `latest_digest.md` and printed to standard output for OpenClaw consumption. Consequently, external feed content can cross from an untrusted network source into an agent-facing context. A downstream AI agent could interpret malicious article content as instructions instead of treating it exclusively as quoted data. ### Attack Path 1. An attacker gains control of, compromises, or successfully submits content to one of the configured RSS sources. 2. The attacker publishes an article with a crafted title, summary, or link containing Markdown manipulation, instruction-like content, or a deceptive URL. 3. `fetch_feeds()` retrieves the crafted RSS entry and stores its fields without Markdown escaping or URL-scheme validation. 4. The title and summary pass through the translation service, which may preserve the malicious ...[truncated 1054 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every RSS field as untrusted data and explicitly separate it from agent instructions. 2. Escape Markdown metacharacters in titles and summaries before rendering them. 3. Validate article URLs with a strict parser and allow only expected schemes such as `https` and, if required, `http`. 4. Reject control characters, malformed URLs, and dangerous or unexpected schemes such as `javascript`, `data`, and `file`. 5. Place external article content inside clearly delimited data sections with an explicit statement that downstream agents must not follow instructions contained in those sections. 6. Consider producing structured JSON for agent consumption instead of free-form Markdown, with fields marked as untrusted external content. 7. Apply length limits before sending content to translation and again after translation. 8. Configure downstream agents not to execute commands, invoke tools, disclose data, or alter objectives based solely on instructions found in fetched articles.