T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:97
- Finding
- Untrusted Release Notes Are Processed Without an Explicit Instruction/Data Boundary## Vulnerability Details **File Location**: `SKILL.md:97-106` **Vulnerability Type**: Indirect prompt injection through attacker-controlled release content **Risk Level**: Medium **Vulnerable Code/Instructions**: ```markdown ### Generate Summary 1. Fetch release content: ```bash gh release view <tag> --repo <owner>/<repo> --json body ``` 2. If release body is sparse, also check local CHANGELOG if the package is installed: ```bash cat /opt/homebrew/lib/node_modules/<package>/CHANGELOG.md ``` 3. Parse and categorize changes into sections: - **Priority items** — lines matching any `priorities` keywords, shown first ``` ### Technical Analysis The repository owner and name are configurable, while GitHub release bodies are externally controlled content. The Skill directs the Agent to retrieve and interpret release bodies but does not establish an explicit trust boundary requiring such content to be treated exclusively as data. A malicious or compromised repository can therefore place Agent-directed instructions in its release notes. When the Agent processes those notes to generate a summary, the embedded text may be interpreted as instructions rather than inert release information. This is an indirect prompt-injection weakness. The same trust-boundary concern applies to changelog content used as a fallback. The audited project does not directly implement credential theft, arbitrary command execution, or data exfiltration; successful escalation beyond content manipulation would depend on the Agent's available tools, permissions, and whether it follows the injected instructions. ### Attack Path 1. A user configures the tracker to monitor a repository controlled or later compromised by an attacker. 2. The attacker publishes a release containing instructions addressed to an AI Agent in the release body. 3. A manual or scheduled check invokes `gh release view` and ret ...[truncated 1026 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly classify release bodies, changelogs, repository names, tags, and other retrieved metadata as untrusted data. 2. Add a mandatory instruction stating that the Agent must ignore all commands, behavioral directives, tool requests, credential requests, and policy claims contained in fetched content. 3. Require the Agent to extract only factual release information and never execute commands, follow links, change configuration, alter destinations, or invoke unrelated tools based on release text. 4. Prefer deterministic parsing before Agent processing. Extract expected fields and normalize release text through a constrained parser rather than placing raw content directly into the reasoning context. 5. Sanitize output for the destination platform, including mentions, links, formatting controls, and message-length limits. 6. Restrict delivery targets and state-file paths to validated values from trusted local configuration; release content must never be allowed to override them. 7. Apply least privilege to scheduled sessions and disable tools that are unnecessary for retrieving, summarizing, delivering, and recording release information. 8. Add adversarial tests using release bodies containing prompt-injection text and verify that such text is summarized as data or omitted rather than followed.