T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:55- Finding
Untrusted Repository Content Is Injected into Privileged Subagent Prompts
- Content
View full analysis
**Additional context from main session:** > > Project README (first 3000 chars): > ``` > $README_CONTENT > ``` > > Package manifest: > ``` > $MANIFEST_CONTENT > ``` > > Use this context to produce more accurate project name, description, and framework detection. The README and manifest are authoritative — prefer their information over heuristics. ``` The tour-generation phase repeats the same unsafe pattern: ```markdown Dispatch a subagent using the prompt template at `./tour-builder-prompt.md`. Read the template file and pass the full content as the subagent's prompt, appending the following additional context: > **Additional context from main session:** > > Project README (first 3000 chars): > ``` > $README_CONTENT > ``` > > Project entry point: `$ENTRY_POINT` > > Use the README to align the tour narrative with the project's own documentation. ``` ### Technical Analysis The Skill reads repository-controlled README and manifest content and directly appends that content to privileged subagent prompts. Markdown code fences are presentational syntax and do not provide an instruction/data security boundary. A malicious repository can place model-directed instruc ...[truncated 1957 chars]- Remediation
View remediation