T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/codex_backend.py:105
- Finding
- Untrusted slide content is delegated to an autonomous full-access Codex agent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/codex_backend.py:105-128` **Related Configuration**: `scripts/codex_backend.py:27` **Vulnerability Type**: Indirect prompt injection through an autonomous subprocess **Risk Level**: High ### Vulnerable Code ```python DEFAULT_CODEX_CMD = "codex exec --full-auto" ``` ```python return ( # Other instruction fields are assembled above. f"{prompt}\n" f"-----END PROMPT-----\n" ) ``` ```python instruction = self._build_instruction(prompt, output_path, reference_image_path) argv = shlex.split(self.codex_cmd) + [instruction] print(f"Dispatching scene {scene_index} to codex ({len(instruction)} chars)") try: result = subprocess.run( argv, capture_output=True, text=True, timeout=self.timeout, check=False, ) except subprocess.TimeoutExpired as e: raise RuntimeError(f"codex execution timed out after {self.timeout}s: {e}") from e ``` ### Technical Analysis Slide content from the user-controlled presentation plan is incorporated into `prompt`, embedded verbatim in a natural-language instruction, and sent to `codex exec --full-auto`. Text delimiters such as `BEGIN PROMPT` and `END PROMPT` do not create an enforceable security boundary for a language model. Malicious content can instruct the nested Codex agent to disregard the surrounding image-generation request and instead use its available tools to read files, modify the workspace, execute commands, or perform network operations. The direct use of `subprocess.run()` is not conventional shell injection because the process is invoked through an argument array. The vulnerability instead arises because untrusted data is supplied as instructions to an autonomous tool-using agent operating in full-auto mode. This behavior exceeds the minimum privileges required to generate a slide image. Image generation should not require granting a second autonomous agent broad access to the caller's filesyste ...[truncated 1530 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the autonomous Codex relay and use a dedicated image-generation API or constrained image-generation tool. 2. If the backend must remain available: - Do not invoke Codex with `--full-auto`. - Require explicit user confirmation before each delegated invocation. - Run Codex in a sandbox with no access to unrelated files. - Restrict writable paths to a newly created output directory. - Disable shell, filesystem-reading, package-management, and unrelated network tools. - Apply outbound network restrictions so only the required image endpoint is reachable. 3. Treat all plan content, template-derived text, and style text as untrusted data. 4. Pass presentation data through a structured interface rather than concatenating it into an agent instruction. 5. Clearly document that the Codex backend delegates content to another autonomous agent and may expose local resources. 6. Add adversarial tests containing prompt-injection instructions and verify that they cannot trigger filesystem, shell, or network actions. ]]>