T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:198- Finding
Untrusted Profile Content Is Injected into the Agent Orchestration Channel
- Content
View full analysis
Vulnerability Details
File Location:
skill.py:95-104andskill.py:198-215
Vulnerability Type: Untrusted semantic instruction injection
Risk Level: MediumVulnerable Code
python class AvatarRoamEngine: """Digital avatar preference extraction and roaming controller.""" def __init__(self): with open(FILE_HABITS, 'r') as f: self.profile = json.load(f) self.avatar_id = self.profile.get("avatar_id", "UNKNOWN_AVATAR") self.overrides = self.profile.get("scene_overrides", {}) def fetch_habit(self, scene_name): return self.overrides.get(scene_name, None)python base_intent = SCENE_MATRIX[target_scene] habit = engine.fetch_habit(target_scene) print(f"🧠 [Semantic Bridge] Translating rigid hardware command to 6-Element Tensor...") time.sleep(0.5) final_intent = base_intent if habit: print(f"✨ [Avatar Habit Injection] Cloud habit found for '{target_scene}'. Overriding default matrix!") final_intent = f"{base_intent} | [AVATAR_MANDATE_OVERRIDE]: {habit}" print("\n🎯 [Final Parsed 4D Intent]:") print(f" >> {final_intent}") # Dispatch to the timeline engine print("\n⏱️ [Timeline Orchestrator] Injecting keyframes into rendered_tracks.json...") track_id = TimelineOrchestratorBridge.inject_track(location, target_scene, final_intent, agent_id) print(f"✅ Track [ {track_id} ] assigned to Swarm Agent [ {agent_id} ] for execution.") # Persist to the memory database print("🗄️ [Chronos Memzero] Logging causality and legal mandate to SQLite DB...") ChronosMemoryBridge.log_mandate(location, engine.avatar_id, target_scene, final_intent)Technical Analysis
The application treats values loaded from the mutable local file
s2_avatar_data/avatar_habits.jsonas trusted mandate instructions. Thescene_overridesobject receives no schema validation, type checking, length restriction, semantic filtering, sou ...[truncated 2458 chars]- Remediation
View remediation
Remediation Suggestions
- Replace free-form preference strings with a strict typed schema containing bounded fields such as temperature, illumination, volume, and enabled capabilities.
- Validate all loaded JSON data before use, including object types, permitted scene names, field lengths, numeric ranges, and enumerated values.
- Reject instruction-like fields and unknown properties rather than forwarding them to the orchestration channel.
- Serialize preferences as structured data and keep them separate from natural-language prompts or Agent control instructions.
- Apply an allowlist of actions that each scene may modify. Require explicit authorization or user confirmation for security-sensitive, privacy-sensitive, or safety-sensitive operations.
- Authenticate the source of profile data and integrity-protect the file, such as through signed records or a message authentication code with securely managed keys.
- Restrict filesystem permissions so only the intended profile-management component can modify
avatar_habits.json. - Treat
rendered_tracks.jsonand database records as untrusted when consumed downstream. Revalidate them at the execution boundary and never grant authority based solely on labels such asAVATAR_MANDATE_OVERRIDE. - Use atomic writes and safe failure behavior so malformed or partially written JSON cannot corrupt the orchestration state.
- Add tests covering oversized values, unexpected types, unknown actions, embedded prompt instructions, and unauthorized profile modifications.