T09 · Insecure Skill Coding Practices
- Location
templates/research-and-post.yaml:5- Finding
Untrusted Web Content Can Be Automatically Published Without Human Approval
- Content
View full analysis
Vulnerability Details
File Location:
templates/research-and-post.yaml:5-23
Vulnerability Type: Indirect prompt injection leading to unauthorized or manipulated social-media publication
Risk Level: MediumVulnerable Code
yaml steps: - id: research action: web_search params: query: "latest AI agent news" count: 5 - id: summarize action: llm params: model: claude prompt: "Summarize these search results into a concise social media post: {{research.output}}" depends_on: [research] - id: post action: social_post params: text: "{{summarize.output}}" platform: twitter depends_on: [summarize]Technical Analysis
The workflow treats web-search results as trusted prompt content. The
research.outputvalue is interpolated directly into the LLM prompt without source restrictions, instruction isolation, sanitization, or validation. Because web-search results may contain attacker-controlled text, a malicious indexed page could include instructions designed to influence the model rather than provide factual source material.The resulting LLM output is then passed directly to the
social_postaction. There is no human approval stage, output policy check, allowlist, or confirmation immediately before publication. This creates an indirect prompt-injection path from untrusted web content to an externally visible side effect.Attack Path
- An attacker publishes a web page that is likely to appear for the configured query, such as content concerning recent AI-agent news.
- The page includes adversarial text instructing an LLM to disregard the summarization task and emit attacker-selected content, misleading claims, links, or promotional material.
- The
web_searchaction returns that page or its attacker-controlled excerpt inresearch.output. - The workflow inserts the untrusted output directly i ...[truncated 989 chars]
- Remediation
View remediation
Remediation Suggestions
- Insert a mandatory human-review and explicit approval step between content generation and
social_post. - Treat all search results as untrusted data. Clearly delimit quoted source material and instruct the model not to follow instructions found inside it.
- Restrict searches to an allowlist of trusted domains where the use case permits it.
- Validate generated posts before publication, including checks for unexpected URLs, mentions, sensitive information, prohibited claims, and instruction-like artifacts.
- Require a second, independent policy-enforcement step to assess factual support, safety, and compliance rather than relying solely on the generating model.
- Configure the social-media integration with the minimum required privileges and provide an emergency revocation mechanism.
- Record source URLs, generated content, validation outcomes, approval identity, and publication results in an audit log.
- Prefer saving generated text as a draft rather than automatically publishing it.
- Insert a mandatory human-review and explicit approval step between content generation and