T09 · Insecure Skill Coding Practices
- Location
SKILL.md:573- Finding
Untrusted Artifact and Reviewer Content Is Inserted Verbatim into Agent Prompts
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:573-591
Vulnerability Type: Prompt injection through unsafe prompt composition
Risk Level: HighVulnerable Code
text You are the [ROLE NAME] in Round 2 of a MiroPRISM review. In Round 1, you reviewed [ARTIFACT DESCRIPTION] and produced the findings below. You are now receiving a sanitized digest of ALL Round 1 findings from all reviewers. Your task: respond to every finding in the digest with AGREE, DISAGREE, or UNCERTAIN. Evidence is required for each stance. --- ## The Artifact Being Reviewed [INSERT ORIGINAL ARTIFACT / LINK TO ARTIFACT] --- ## Your Round 1 Output [INSERT THIS REVIEWER'S r1-outputs/<role>.md VERBATIM] --- ## Round 1 Digest (all reviewers, sanitized, randomized) [INSERT r1-digest.md VERBATIM]Technical Analysis
The Round 2 prompt template directly interpolates the original reviewed artifact and each reviewer's Round 1 output into an executable agent prompt. Both inputs may be attacker-controlled:
- A submitted artifact can contain instructions aimed at the reviewing agent.
- A compromised or injection-affected Round 1 reviewer can reproduce or generate malicious instructions in its output.
- The Round 1 digest is sanitized, but the original artifact and the individual Round 1 output explicitly remain verbatim.
This defeats the claimed digest-layer prompt-injection protection. Sanitizing only
r1-digest.mddoes not establish a security boundary when two other untrusted channels are concatenated into the same prompt.The statement at
SKILL.md:573—“You are now receiving a sanitized digest of ALL Round 1 findings from all reviewers”—is ordinary workflow context and is not independently an instruction-hijacking vulnerability. The vulnerability arises from the adjacent verbatim insertion points at lines 581, 586, and 591.Attack Path
- An attacker submits an artifact containing embedded instructions, such as directions to ignore the review protocol ...[truncated 1920 chars]
- Remediation
View remediation
Remediation Suggestions
-
Do not concatenate untrusted text into instruction messages. Supply artifacts and reviewer outputs through a distinct data or attachment channel supported by the host platform.
-
Explicitly define all reviewed material as untrusted evidence. Add a higher-priority instruction before any artifact content stating that instructions, role changes, tool requests, or policy claims found inside artifacts and reviewer outputs must never be followed.
-
Use strong content boundaries. Pass opaque file references where possible. If inline content is unavoidable, use structured fields with length limits and escaping rather than free-form prompt concatenation. Delimiters alone should not be treated as a complete defense.
-
Sanitize every cross-agent channel. Apply injection detection and structured extraction to:
- The original artifact
- Every Round 1 output
- The Round 1 digest
- Round 2 new findings
- All content entering final synthesis
-
Avoid verbatim propagation. Convert Round 1 output into an allowlisted schema containing only finding type, location, declarative description, evidence references, and verdict. Reject imperative language and unexpected fields.
-
Apply least privilege to reviewer agents. Grant read-only access to the reviewed project where feasible, restrict writes to the designated run directory, and disable shell, network, credential, and unrelated filesystem access unless explicitly required.
-
Validate outputs before synthesis. Reject responses containing instruction-like content, unauthorized tool-action claims, unrelated data, suspicious context disclosure, or malformed fields.
-
Correct the security claim. Replace the assertion that prompt injection “is blocked” with a scoped statement explaining that digest sanitization reduces one propagation path but does not protect verbatim artifacts or reviewer outputs.
-