T09 · Insecure Skill Coding Practices
Error
- Location
scripts/red_team_cli.py:191- Finding
Untrusted Task Content Is Embedded Directly into a System Prompt
- Content
View full analysis
str: if team not in RED_TEAM_PROMPTS: raise ValueError(f"Unknown team: {team}") return RED_TEAM_PROMPTS[team]["prompt"].format( task=task.strip(), decomposition=decomposition.strip(), ) ``` The resulting prompt is exposed as a system prompt intended to be sent to the host model: ```python prompt = cls.get_prompt(team, task, decomposition) results[team] = { "name": RED_TEAM_PROMPTS[team]["name"], "system_prompt": prompt, "expected_output_format": "XML ", } ``` ### Technical Analysis The `task` and `decomposition` arguments are attacker-influenced CLI inputs. They are inserted directly into a prompt that the surrounding workflow explicitly designates as a system prompt. No trust boundary, structural separation, escaping, or instruction-content validation is applied. Consequently, an attacker can place prompt instructions inside either input. Once interpolated, those instructions appear within the same system-level message as the fixed red-team policy and may compete with or override the intended review instructions. This is an insecure prompt-construction practice rather than evidence that the packaged Skill intentionally hijacks the agent. The project does not itself call a model API or execute tools based on the generated output, so exploitation depends on a downstream caller following the documented instruction to send the generated prompt to a host model. ### Attack Path 1. An attacker supplies a crafted value through `--task` or `--decomposition`. 2. The value includes instructions such as directing the model to ignore the red-team rules, suppress findings, change the output format, or reveal un ...[truncated 982 chars]- Remediation
View remediation