Query DBpedia using Natural Language

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.0

Overview

This skill coherently queries DBpedia and generates reports, with no hidden persistence or privilege behavior, though users should be careful with sensitive prompts and generated HTML.

Install only if you are comfortable sending query terms to DBpedia. Do not include secrets, private names, internal project terms, or sensitive personal data in prompts, and review or sanitize generated HTML before opening or sharing reports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/html-template.html:6

Finding

Unescaped Dynamic Content in Generated HTML

Content

View full analysis

Vulnerability Details

File Location: templates/html-template.html:6, 181-182, 188, 194, 201
Vulnerability Type: HTML injection and potential cross-site scripting in generated reports
Risk Level: Medium

Vulnerable Code

html

<title>{{TITLE}} - DBpedia Query Results</title>

html

<h1>{{TITLE}}</h1>
<div class="subtitle">{{SUBTITLE}}</div>

html

<div class="stats">
    {{STATS}}
</div>

html

<thead>
    <tr>
        {{TABLE_HEADERS}}
    </tr>
</thead>
<tbody>
    {{TABLE_ROWS}}
</tbody>

html

<code>{{SPARQL_QUERY}}</code>

Technical Analysis

The HTML template inserts multiple dynamic placeholders directly into HTML document contexts. The project does not include an implementation that applies contextual output encoding, and SKILL.md does not require generated values to be escaped before substitution.

The affected values may originate from a user's question, a generated SPARQL query, or data returned by the remote DBpedia endpoint. If the generation process performs literal string replacement, characters such as <, >, &, ", and ' can be interpreted as HTML syntax instead of text.

TITLE, SUBTITLE, and SPARQL_QUERY require HTML text-context encoding. STATS, TABLE_HEADERS, and TABLE_ROWS represent complete markup fragments and therefore require safe element construction with every embedded value encoded. Dynamically generated link destinations additionally require URI parsing and an explicit scheme allowlist.

Attack Path

1. An attacker supplies a crafted natural-language question or causes a malicious value to be present in remotely retrieved result data.
2. The Skill incorporates that value into a title, subtitle, table cell, URI, statistics block, or displayed SPARQL query.
3. The value is substituted into the template without contextual encoding or URI validation.
4. The Skill saves the resulting document as an HTML report.
5. A user opens that report in a browser.
6. Inj ...[truncated 815 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply contextual HTML encoding to every dynamic text value before insertion. At minimum, encode &, <, >, ", and '.
2. Do not construct STATS, TABLE_HEADERS, or TABLE_ROWS through untrusted string concatenation. Use a vetted auto-escaping template engine or create elements with DOM APIs and assign untrusted data through textContent.
3. Parse dynamically generated hyperlinks as URLs and allow only explicitly approved https: destinations. Reject schemes such as javascript:, data:, and file:.
4. Treat the displayed SPARQL query as text and escape it before placing it inside <code>.
5. Add a restrictive Content Security Policy, for example one that blocks inline and external scripts unless explicitly required.
6. Add rel="noopener noreferrer" to links using target="_blank".
7. Update SKILL.md to make contextual output encoding and URL validation mandatory parts of HTML generation.
8. Add tests using payloads such as HTML tags, event-handler attributes, closing-tag sequences, and unsafe URI schemes, verifying that they are displayed as inert text.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The query template enforces FILTER(LANG(?label) = 'en'), which forces English output as a default behavior. The document does not offer users a language choice or explain that the skill is intentionally limited to English for a justified region-specific reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction Filter by language: Use FILTER(LANG(?label) = 'en') establishes an organizational language policy violation by requiring English labels universally. No opt-in, locale selection, or documented justification is provided anywhere in the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown repeatedly instructs and exemplifies filtering labels with LANG(...)= 'en', which constrains outputs to English. Because the file presents this as a general query pattern rather than an optional or justified locale-specific behavior, it creates a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction Always filter by language for labels follows a document full of English-only examples and therefore implicitly enforces English-centric behavior. This is a policy concern because it removes user choice on language/locale and does not justify the restriction as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states that the skill converts user questions to SPARQL and executes them against DBpedia, but it does not clearly warn users that their prompts and derived queries will be transmitted to a third-party remote endpoint. This can expose sensitive or proprietary user input if someone uses the skill for internal research or includes confidential terms in queries, making the omission a real privacy/security disclosure issue even though the endpoint is read-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML root sets lang="en", which forces the rendered document to be identified as English regardless of the user's locale or the actual content inserted into the template. The policy flags language or locale constraints when they are imposed without opt-in or clear region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.