T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/strategies.py:103- Finding
Conversation summaries promote untrusted message content to system-level instructions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/strategies.py:103-149
Vulnerability Type: Prompt-injection privilege elevation through unsafe role conversion
Risk Level: MediumVulnerable Code
python # Generate summary summary_parts = [] user_topics = [] assistant_actions = [] tool_results = [] for msg in old_messages: role = msg.get("role", "unknown") content = msg.get("content", "") if not content or content == "[工具输出已清理-超时]": continue if role == "user": # Extract the user's request topic using the first 100 characters topic = content[:100].strip() if len(content) > 100: topic += "..." user_topics.append(topic) elif role == "assistant": # Extract the assistant's action action = content[:100].strip() if len(content) > 100: action += "..." assistant_actions.append(action) elif role == "tool": # Briefly record the tool result tool_name = msg.get("name", "unknown_tool") tool_results.append(f"{tool_name}") # Build summary text if user_topics: summary_parts.append(f"用户请求({len(user_topics)}条): " + "; ".join(user_topics[:5])) if len(user_topics) > 5: summary_parts[-1] += f" ...等{len(user_topics)}条" if assistant_actions: summary_parts.append(f"助手操作({len(assistant_actions)}条): " + "; ".join(assistant_actions[:5])) if len(assistant_actions) > 5: summary_parts[-1] += f" ...等{len(assistant_actions)}条" if tool_results: unique_tools = list(set(tool_results)) summary_parts.append(f"使用工具({len(tool_results)}次): " + ", ".join(unique_tools[:10])) summary_text = "[历史对话摘要] " + " | ".join(summary_parts) if summary_parts else "[历史对话摘要] 无重要内容" # Build the new message list summary_msg = { "role": "system", "content": summary_text, "_is_summary": True, "_summari ...[truncated 2129 chars]- Remediation
View remediation
Remediation Suggestions
- Do not place summaries derived from user or tool content into a
systemmessage. Use a non-privileged role or a dedicated metadata field interpreted by trusted application code. - Preserve provenance for every summarized item, including its original role and message identifier.
- If system-level placement is unavoidable, prepend a fixed developer-controlled instruction stating that the enclosed material is untrusted quoted data and must never be interpreted as instructions.
- Place summaries inside explicit data delimiters and ensure user-controlled text cannot terminate or imitate those delimiters.
- Use a summarization process that extracts factual state rather than copying leading message text verbatim.
- Add adversarial tests using instructions at the beginning of old user messages. Verify that compression never changes their authority or emits them as executable system instructions.
- Apply output validation to reject or neutralize instruction-like summary content before constructing the compressed context.
- Do not place summaries derived from user or tool content into a