T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:573
- Finding
- Untrusted Artifact and Reviewer Content Is Inserted Verbatim into Agent Prompts## Vulnerability Details **File Location**: `SKILL.md:573-591` **Vulnerability Type**: Prompt injection through unsafe prompt composition **Risk Level**: High ### Vulnerable Code ```text You are the [ROLE NAME] in Round 2 of a MiroPRISM review. In Round 1, you reviewed [ARTIFACT DESCRIPTION] and produced the findings below. You are now receiving a sanitized digest of ALL Round 1 findings from all reviewers. Your task: respond to every finding in the digest with AGREE, DISAGREE, or UNCERTAIN. Evidence is required for each stance. --- ## The Artifact Being Reviewed [INSERT ORIGINAL ARTIFACT / LINK TO ARTIFACT] --- ## Your Round 1 Output [INSERT THIS REVIEWER'S r1-outputs/<role>.md VERBATIM] --- ## Round 1 Digest (all reviewers, sanitized, randomized) [INSERT r1-digest.md VERBATIM] ``` ### Technical Analysis The Round 2 prompt template directly interpolates the original reviewed artifact and each reviewer's Round 1 output into an executable agent prompt. Both inputs may be attacker-controlled: - A submitted artifact can contain instructions aimed at the reviewing agent. - A compromised or injection-affected Round 1 reviewer can reproduce or generate malicious instructions in its output. - The Round 1 digest is sanitized, but the original artifact and the individual Round 1 output explicitly remain verbatim. This defeats the claimed digest-layer prompt-injection protection. Sanitizing only `r1-digest.md` does not establish a security boundary when two other untrusted channels are concatenated into the same prompt. The statement at `SKILL.md:573`—“You are now receiving a sanitized digest of ALL Round 1 findings from all reviewers”—is ordinary workflow context and is not independently an instruction-hijacking vulnerability. The vulnerability arises from the adjacent verbatim insertion points at lines 581, 586, and 591. ### Attack Path 1. An attacker submits an artifact containing embedded instructions, such as directions to ignore the review protocol ...[truncated 1920 chars]
- Remediation
- ## Remediation Suggestions 1. **Do not concatenate untrusted text into instruction messages.** Supply artifacts and reviewer outputs through a distinct data or attachment channel supported by the host platform. 2. **Explicitly define all reviewed material as untrusted evidence.** Add a higher-priority instruction before any artifact content stating that instructions, role changes, tool requests, or policy claims found inside artifacts and reviewer outputs must never be followed. 3. **Use strong content boundaries.** Pass opaque file references where possible. If inline content is unavoidable, use structured fields with length limits and escaping rather than free-form prompt concatenation. Delimiters alone should not be treated as a complete defense. 4. **Sanitize every cross-agent channel.** Apply injection detection and structured extraction to: - The original artifact - Every Round 1 output - The Round 1 digest - Round 2 new findings - All content entering final synthesis 5. **Avoid verbatim propagation.** Convert Round 1 output into an allowlisted schema containing only finding type, location, declarative description, evidence references, and verdict. Reject imperative language and unexpected fields. 6. **Apply least privilege to reviewer agents.** Grant read-only access to the reviewed project where feasible, restrict writes to the designated run directory, and disable shell, network, credential, and unrelated filesystem access unless explicitly required. 7. **Validate outputs before synthesis.** Reject responses containing instruction-like content, unauthorized tool-action claims, unrelated data, suspicious context disclosure, or malformed fields. 8. **Correct the security claim.** Replace the assertion that prompt injection “is blocked” with a scoped statement explaining that digest sanitization reduces one propagation path but does not protect verbatim artifacts or reviewer outputs.