T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:65- Finding
Untrusted Remote Content Enters an Executable Prompt Pipeline Without Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:65-70,SKILL.md:76-102, andreferences/content-deconstructor.md:117-119
Vulnerability Type: Indirect prompt injection through untrusted fetched content
Risk Level: MediumVulnerable Code Snippets:
SKILL.md:65-70markdown ### Step 2: Content Deconstruction 1. Fetch content from all reference URLs (use web_fetch tool) 2. For Twitter/X URLs, transform to FxTwitter API: `https://api.fxtwitter.com/username/status/123456` 3. Analyze each piece following the `references/content-deconstructor.md` guide 4. Save the combined breakdown to `content-breakdown/breakdown-{timestamp}.md` 5. Report: "✓ Content breakdown saved"SKILL.md:76-102markdown ### Step 4: Content Context Generation 1. Analyze the anatomy guide following `references/content-context-generator.md` 2. Generate context questions covering: - Topic & subject matter - Target audience - Goals & outcomes - Voice & positioning 3. Save to `content-context/context-{timestamp}.md` 4. Report: "✓ Context requirements saved" ### Step 5: Meta Prompt Generation 1. Following `references/meta-prompt-generator.md`, create a two-phase prompt: **Phase 1 - Context Gathering:** - Interview user for ideas they want to write about - Use context questions from Step 4 - Ask up to 10 questions if needed **Phase 2 - Content Writing:** - Write 3 variations of each content type - Follow structural patterns from the anatomy guide 2. Save to `content-meta-prompt/meta-prompt-{timestamp}.md` 3. Report: "✓ Meta prompt saved"references/content-deconstructor.md:117-119markdown 2. **Be Actionable:** Every insight should help someone recreate the effect 3. **Be Thorough:** Cover all five analysis areas 4. **Quote Examples:** When useful, quote specific phrases that demonstrate techniquesTechnical Analysis
The skill fetches arbitrary ...[truncated 3037 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit trust-boundary rule stating that all fetched content is untrusted data and that instructions, requests, tool commands, role declarations, or policy text found within it must never be followed.
- Place fetched text inside clearly marked data delimiters and keep it separate from operational prompts.
- Detect and remove or neutralize instruction-like passages before transferring remote text into breakdowns, anatomy guides, context documents, or meta-prompts.
- Do not copy remote text verbatim into executable prompts. When examples are necessary, quote only narrowly selected content and encode or label it as non-executable source material.
- Require a review checkpoint before executing any generated meta-prompt, showing the prompt to the user or applying a security validation pass that detects unexpected tool-use instructions and unrelated objectives.
- Ensure generated prompts have an explicit scope, an allowlist of permitted operations, and a prohibition against tool calls derived from reference content.
- Define URL validation precisely: allow only HTTP(S), reject embedded credentials and malformed hosts, resolve hostnames before access, and block loopback, private, link-local, multicast, reserved, and cloud metadata addresses.
- Revalidate every redirect target and apply limits for redirects, response size, content type, and fetch duration.
- Record source provenance through every generated artifact so remote content can be distinguished from trusted workflow instructions.
- Add adversarial tests using pages that contain prompt injections, fake system messages, tool-call requests, and encoded instructions to verify that none affect downstream execution.