T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Untrusted Web Content Is Processed Without Prompt-Injection Defenses
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-32
Vulnerability Type: Indirect prompt injection through remotely retrieved content
Risk Level: MediumVulnerable Instruction Segment
The following is an English rendering of the complete relevant instruction segment:
markdown If the web_search tool is available, use web_search to search by category with country=CN, language=zh, and freshness=day. If web_search is unavailable, use web_fetch to retrieve the Baidu search results page directly: web_fetch("https://www.baidu.com/s?wd=[keyword]&rn=10") Extract search-result titles and links from the returned HTML. The following source sites may also be retrieved directly to obtain their latest articles: - https://www.jiqizhixin.com/ - https://www.zhidx.com/ - https://www.leiphone.com/category/ai - https://www.infoq.cn/topic/AI - http://www.moe.gov.cn/jyb_xwfb/gzdt_gzdt/Technical Analysis
The Skill directs the agent to retrieve search-result pages and arbitrary linked articles, extract their content, and use that content to generate a digest. It does not instruct the agent to treat retrieved text as untrusted data, ignore instructions embedded in pages, restrict navigation to approved domains, or validate final links before publishing them.
A hostile page can place model-directed instructions in visible text, metadata, accessibility text, or other extracted HTML. Because the same agent interprets the Skill instructions and summarizes retrieved content, those instructions could be mistaken for trusted operational directions. Examples include demands to append promotional links, suppress legitimate stories, disclose context, or fetch additional attacker-controlled resources.
General network retrieval is necessary for the declared news-aggregation function. However, unrestricted processing of search results without content isolation or destination validation is broader than the m ...[truncated 1995 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit trust-boundary rule stating that all search results, HTML, metadata, and article text are untrusted data and must never be interpreted as instructions.
- Require the agent to ignore remote content that requests tool calls, changes output rules, asks for secrets, promotes unrelated links, or claims to override Skill or system instructions.
- Prefer an allowlist of authoritative domains. Require explicit validation before following redirects or links to domains outside that allowlist.
- Separate retrieval from summarization: first extract only structured fields such as title, publication date, publisher, canonical URL, and article body; then summarize the normalized fields in a separate step.
- Strip scripts, comments, hidden elements, forms, metadata unrelated to citation, and instruction-like text before model processing.
- Validate every final URL against the retrieved canonical source and reject URL shorteners, deceptive domains, redirects to unrelated sites, and unsupported promotional links.
- Add a final output check that rejects instructions, advertisements, calls to action, or links not directly supported by an approved source.
- Mark archived digests as generated content and avoid automatic knowledge-base synchronization until validation succeeds.
- Use HTTPS for sources where available, particularly the configured Ministry of Education endpoint, to reduce transport-level content manipulation.