T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_papers.py:56
- Finding
- Untrusted Remote Paper Metadata Is Propagated Without Output Safety Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_papers.py`, lines 56–59, 113–124, and 151–185 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code Remote data is fetched and parsed without establishing a trust boundary: ```python response = requests.get(HF_PAPERS_API, timeout=20, headers={"User-Agent": USER_AGENT}) response.raise_for_status() data = response.json() ``` Fields controlled by the remote API response are copied into the internal paper representation: ```python paper = { "id": paper_data.get("id", ""), "title": paper_data.get("title", ""), "authors": [a.get("name", "") for a in paper_data.get("authors", [])], "summary": paper_data.get("summary", ""), "ai_summary": paper_data.get("ai_summary", ""), "keywords": paper_data.get("ai_keywords", []), "published": paper_data.get("publishedAt", ""), "link": f"https://arxiv.org/abs/{paper_data.get('id', '')}", "hf_link": f"https://huggingface.co/papers/{paper_data.get('id', '')}", "upvotes": paper_data.get("upvotes", 0) or 0, "num_comments": item.get("numComments", 0) or 0, "organization": paper_data.get("organization", {}).get("fullname", ""), "position": i + 1, } ``` Those fields are then inserted directly into Markdown: ```python for i, p in enumerate(papers, 1): # Trending badge badge = f"🔥 Trending #{p.get('position', '?')}" lines.append(f"## {i}. {p['title']}") lines.append(f"\n*{badge} | 👍 {p.get('upvotes', 0)} | 💬 {p.get('num_comments', 0)}*") if p.get('organization'): lines.append(f"\n**机构:** {p['organization']}") lines.append(f"\n**Authors:** {', '.join(p['authors'][:3])}" + (f" et al." if len(p['authors']) > 3 else "")) lines.append(f"\n**Links:** [arXiv]({p['link']}) | [HF]({p['hf_link']})") if p.get('keywords'): lines.append(f"\n**Keywords:** {', '.join(p['keywords'][:5])}") ...[truncated 3011 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Validate the API response schema** - Require the top-level response to be a list. - Verify that each paper entry and nested field has the expected type. - Reject or normalize unexpected objects, arrays, and excessively long strings. - Permit only expected arXiv identifier characters before constructing URLs. 2. **Escape output for its destination** - Escape Markdown control characters in titles, authors, organizations, keywords, and summaries. - Construct links only from validated identifiers. - Consider emitting plain text when rich Markdown is unnecessary. 3. **Establish explicit agent-facing trust boundaries** - Wrap external content in clearly marked delimiters. - State that enclosed paper metadata is untrusted reference data and must not be interpreted as instructions, tool requests, or policy. - Keep system instructions and retrieved content in separate message or data fields where the consuming framework supports this. 4. **Apply strict length limits** - Limit every external string field, not only summaries. - Limit collection sizes for authors and keywords. - Reject records that exceed reasonable structural limits. 5. **Harden downstream consumers** - Configure agents not to execute tools based solely on retrieved paper content. - Require explicit user confirmation for consequential actions. - Sanitize rendered Markdown and restrict unsafe URL schemes, remote images, and raw HTML. 6. **Add adversarial tests** - Test titles and summaries containing Markdown links, images, raw HTML, nested formatting, and instruction-like text. - Verify that such payloads remain inert data in both Markdown and agent-processing workflows. ]]>