other
Warning
- Location
SKILL.md:54- Finding
Untrusted RSS Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
` tags, summaries within `` tags, and links within `` tags. Simply extract them from the markdown text returned by `web_fetch`. ``` ### Technical Analysis The workflow imports attacker-influenced RSS content directly into the agent context and tells the agent to extract information from the markdown returned by `web_fetch`. It does not establish a trust boundary between skill instructions and external feed content, nor does it instruct the agent to ignore commands or behavioral directives embedded in RSS fields. An attacker who controls an RSS entry, compromises a listed feed, or interferes with feed delivery could insert model-directed instructions into a title, description, or another XML field. If the agent interprets those instructions as operational guidance rather than inert news data, the fetched content could alter the generated briefing or attempt to induce unintended tool usage. ### Attack Path 1. An attacker publishes a crafted item to a feed they control or compromises one of the configured RSS sources. 2. The attacker embeds instructions aimed at the agent in an RSS title or description. 3. The skill retrieves the feed using `web_fetch`. 4. The fetched text is placed in the agent context without explicit isolation or sanitization. 5. While extracting and summarizing the item, the agent may follow the embedded instruction. 6. Depending on the host agent's available tools and confirmation controls, this may manipulate the output or prompt attempts to perform unrelated actions. ### Impact Assessment The d ...[truncated 651 chars]- Remediation
View remediation