T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/find_contacts.py:130
- Finding
- Prompt Injection Through Untrusted Search Result Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/find_contacts.py:130-153` **Vulnerability Type**: Prompt injection through untrusted external content **Risk Level**: Medium ### Vulnerable Code ```python combined = "\n\n".join(snippets[:15]) # limit tokens name_hint = f" for person named '{name}'" if name else "" prompt = f"""Extract professional contact information{name_hint} from the following search snippets. Focus on domain: {domain} For each contact found, return a JSON array with objects containing: - "email": email address (string or null) - "linkedin": LinkedIn URL (string or null) - "title": job title (string or null) - "name": person name (string or null) - "confidence": "high" if email found directly in text, "medium" if inferred from context, "low" if uncertain Only return valid JSON array. If nothing found, return []. SNIPPETS: {combined}""" try: response = client.chat.completions.create( model="gpt-4o-mini", messages=[{"role": "user", "content": prompt}], temperature=0.1, max_tokens=1000 ) ``` ### Technical Analysis Search result titles, descriptions, and URLs originate from external websites and are therefore attacker-controlled. The application concatenates this content directly into the same user message that contains the extraction instructions. No strong trust boundary distinguishes application instructions from the untrusted snippets. An attacker can publish indexed content containing instructions such as requests to disregard the extraction task and return fabricated JSON. The language model may follow those embedded instructions because they appear in its active prompt. The response is accepted after only a permissive regular-expression search and JSON parsing. There is no strict output schema, field allowlist, semantic validation, or independent confirmation that returned values appeared in the source snippets. ### Attack Path 1. An attacker publishes a page likely to ...[truncated 1005 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Place extraction policy in a system message and explicitly state that snippet content is untrusted data that must never be treated as instructions. - Delimit each snippet using a structured representation such as JSON rather than interpolating it into free-form instructions. - Use OpenAI structured output or JSON-schema enforcement with an exact field allowlist and strict types. - Reject output containing unexpected keys, invalid email addresses, unsupported URL schemes, or values that cannot be traced to a supplied snippet. - Independently verify extracted email addresses and profile URLs before assigning confidence. - Consider processing snippets separately to reduce the effect of one malicious result on all extracted contacts. - Add adversarial tests containing instructions such as “ignore previous instructions” to verify that the extraction boundary is effective. ]]>