T09 · Insecure Skill Coding Practices
Warning
- Location
reference/config/analysis.yaml:9- Finding
Untrusted Scraped Content Is Embedded Directly into Model Prompts
- Content
View full analysis
Vulnerability Details
File Location:
reference/config/analysis.yaml:9-25, 35-47, 54-66, 75-87
Vulnerability Type: Prompt injection through untrusted external content
Risk Level: MediumVulnerable Code
yaml pricing_analysis: prompt: | Compare {{our_pricing}} to {{competitor_pricing}} for {{competitor_name}}. Our pricing: {{our_pricing}} Competitor pricing: {{competitor_pricing}} Analyze: 1. Price comparison by tier (where are we higher/lower?) 2. Feature gaps at each price point 3. Value proposition differences 4. Recommended adjustments (specific prices or features to change) 5. Overall market positioning observation Output as structured analysis with specific numbers and actionable recommendations. sentiment_analysis: prompt: | Analyze the sentiment of these {{platform}} reviews for {{competitor_name}}: {{reviews}} For each review, classify as: positive, negative, or neutral. Then summarize: - Overall sentiment score (0-1, where 1 is most positive) - Top 3 praise themes (what people love) - Top 3 complaint themes (what people hate) - Any mentions of {{our_company_name}} (direct comparisons) - Key opportunities for us (competitor weaknesses) product_gap_analysis: prompt: | Compare the product offerings of {{our_company_name}} vs {{competitor_name}}. Our features: {{our_features}} Competitor features: {{competitor_features}} Identify: 1. Features only we have (our moat) 2. Features only they have (their moat) 3. Features we both have (table stakes) 4. Potential features to build (gap opportunities) 5. Features to sunset (no longer competitive) Rank gap opportunities by impact (High/Medium/Low). trend_analysis: prompt: | Analyze 4-week trends for {{competitor_name}}: Historical data: {{trend_data}} Identify: 1. Significant trends (upward or downward) 2. Correlations (e.g ...[truncated 2848 chars]- Remediation
View remediation
Remediation Suggestions
- Treat all scraped and user-generated material as untrusted data, regardless of its source.
- Place external content inside explicit boundaries, such as structured JSON fields or uniquely generated delimiters, rather than concatenating it into instructional prose.
- Add a strong instruction before external content stating that text inside the data boundary is evidence to analyze and that any commands, role changes, tool requests, or policy statements within it must not be followed.
- Parse scraped pages into a strict schema and retain only expected fields. Reject unexpected markup, control text, oversized values, and fields that do not match the schema.
- Separate data extraction from reasoning. Use deterministic parsers for prices, ratings, dates, and counts before passing normalized values to the model.
- Run analyzers without shell, filesystem, network, delivery, or secret access unless each capability is essential. Require explicit authorization before performing side effects.
- Validate generated reports before delivery. Detect instruction-following artifacts, unexpected secret-like material, external links, and unsupported claims.
- Preserve source provenance so every generated claim can be traced to its originating URL and collected value.
- Add adversarial tests containing prompt-injection payloads in pricing pages, reviews, features, and trend data, and verify that the model treats them solely as quoted evidence.