T09 · Insecure Skill Coding Practices
Warning
- Location
src/analyzer.ts:36- Finding
Indirect Prompt Injection Through Untrusted Search Results
- Content
View full analysis
`[${i + 1}] ${a.title}\nURL: ${a.url}\n내용: ${a.content}`) .join('\n\n'); const systemPrompt = `경쟁사 분석 전문가입니다. 주어진 정보를 바탕으로 경쟁사 프로필을 작성하십시오. 반드시 아래 JSON 형식으로만 응답하십시오. 순수 JSON만 출력하십시오. { "description": "경쟁사를 2문장으로 설명", "key_features": ["핵심 기능 1", "핵심 기능 2", "핵심 기능 3"], "pricing_model": "가격 모델 설명 (모르면 '정보 없음')", "positioning": "타겟 시장과 포지셔닝 한 문장", "sources": ["사용한 URL 1", "URL 2"] }`; const userMessage = `경쟁사: ${competitor}\n\n수집된 정보:\n${articlesText}`; ``` ### Technical Analysis Titles, URLs, and content excerpts returned by Tavily originate from untrusted external websites. The Skill inserts this material directly into an LLM user message without a clear data boundary or an instruction requiring the model to ignore commands contained in retrieved documents. A malicious web page can include text that resembles model instructions, such as directions to disregard the requested analysis, fabricate product properties, promote an attacker-controlled URL, or emit manipulated JSON fields. Requiring JSON output constrains formatting but does not prevent semantic prompt injection. The resulting competitor profile is subsequently incorporated into comparison-matrix and recommendation prompts. Consequently, manipulated content can propagate through several analysis stages and affect the final report. ### Attack Path 1. An attacker publishes or modifies a web page associated with a competitor. 2. The page contains search-relevant text and embedded instructions directed at an LLM. 3. Tavily indexes the page and returns its title, URL, or content excerpt. 4. `buildCompetitorProfile()` concatenates the attacker-controlled material into `articlesText`. 5. The mat ...[truncated 1029 chars]- Remediation
View remediation