T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:219
- Finding
- Untrusted Subagent Results Are Interpolated into Executable Prompts## Vulnerability Details **File Location**: `SKILL.md`, lines 219-222 **Vulnerability Type**: Indirect prompt injection through unsanitized subagent output **Risk Level**: Medium ### Vulnerable Code ```python # Inject sibling results sibling_context = collect_sibling_results(state, node) full_prompt = f"{node['prompt']}\n\nContext from prior work:\n{sibling_context}" sessions_spawn(task=full_prompt, label=node_id) ``` The corresponding helper implementation in `references/state-helpers.md`, lines 71-81 and 101-110, shows that dependency results are copied verbatim: ```python def collect_sibling_results(state, node) -> str: """Gather results from completed siblings for fork context injection.""" results = [] for dep_id in node["blockedBy"]: dep = state["nodes"][dep_id] if dep["status"] == "complete" and dep["result"]: results.append(f"[{dep_id}] {dep['goal']}:\n{dep['result']}") return "\n\n---\n\n".join(results) ``` ```python context = collect_sibling_results(state, node) full_prompt = f"""{node['prompt']} ## Context from Prior Work {context} """ result = sessions_spawn( task=full_prompt, label=node_id.replace("#", "node-"), runTimeoutSeconds=600 ) ``` ### Technical Analysis Completed subagent results are concatenated directly into the task prompt of a downstream forked agent. The implementation does not validate the expected structure of those results, distinguish trusted instructions from untrusted data, escape instruction-like content, or direct the receiving agent to treat inherited material solely as evidence. Subagents may process attacker-controlled web content, documents, repository files, or human-provided data. If such material contains prompt-injection instructions and a subagent reproduces them in its final result, those instructions become part of the next agent's executable prompt context. The receiving agent may interpret them as directions rather than quoted data. The ...[truncated 1516 chars]
- Remediation
- ## Remediation Suggestions 1. Pass predecessor results through structured data fields rather than concatenating them directly into instruction text. 2. Add an explicit instruction before inherited content stating that it is untrusted data, may contain adversarial instructions, and must not override system, developer, user, or node-level instructions. 3. Enclose each result in strong data delimiters and identify its source and trust level. 4. Validate results against task-specific schemas and reject unexpected instruction-like fields where practical. 5. Apply length limits and content filtering before propagating results between agents. 6. Give synthesis agents only the minimum tools and permissions required for their task. 7. Require human approval before downstream agents perform sensitive writes, external communications, credential access, or other consequential actions. 8. Track provenance across nodes so content derived from untrusted sources remains marked as untrusted throughout the task tree. 9. Add adversarial tests covering results that contain commands such as requests to ignore prior instructions, invoke tools, reveal data, or modify the task tree.