T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:121- Finding
Persistent Prompt Injection Through Untrusted Style Fingerprints
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 121-140
Vulnerability Type: Persistent indirect prompt injection caused by unsafe handling of untrusted content
Risk Level: MediumRelevant instruction excerpt translated into English:
markdown ### Step 1: Style distillation (distill) - Receive content samples uploaded by the author (text/image OCR text/text extracted from links) - Invoke the LLM to analyze six dimensions of style characteristics - The LLM returns a structured style fingerprint JSON - Validate the completeness of the six fields - Return the style fingerprint for author preview and confirmation ### Step 2: Style saving (save) - Receive the style fingerprint JSON confirmed by the author - Write the style fingerprint to a JSON file (style_fingerprints/{author_id}.json) - If the file exists, overwrite and update it while retaining timestamps - Store the complete style fingerprint JSON in the raw_analysis field ### Step 4: Content generation injection (automatic) - Read the author's style fingerprint JSON during content generation - Parse the six style characteristics - Concatenate them into a style description - Inject the description into the semi-static layer of the content-generation prompt - Require the LLM to follow the style fingerprintTechnical Analysis
The Skill processes user-supplied writing samples with an LLM and stores the resulting fingerprint fields in persistent JSON files. Several fields, including sentence structure, rhythm, rhetorical preferences, emotional tone, style summary, and
raw_analysis, are unrestricted natural-language values.The saved values are subsequently concatenated into the semi-static prompt layer used for content generation. The instructions do not define:
- An allowlist or strict schema for free-text values
- Maximum field lengths
- Escaping or canonical serialization rules
- Separation between trust ...[truncated 2481 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat uploaded samples, LLM output, saved fingerprints, and
raw_analysisas untrusted data. - Replace unrestricted categorical fields with strict enumerations. For example, allow only predefined values for tone and emotional classification.
- Apply maximum lengths, character restrictions, type validation, and allowed-value checks to every fingerprint field.
- Do not persist unrestricted
raw_analysis. If it is operationally required, store it separately and never inject it into prompts. - Serialize fingerprint data as a clearly delimited data object instead of concatenating values into instructional prose.
- Add an explicit trusted instruction stating that fingerprint fields are descriptive data and that commands, requests, or policy statements inside them must not be followed.
- Detect and reject imperative or instruction-like content in generated fingerprint fields before saving.
- Require a structured review screen that exposes every value that will later enter a prompt.
- Use a tool-free LLM context for style-based content generation whenever possible.
- If tools are required, enforce a separate authorization layer that does not rely on model output and grants only the minimum tools and paths needed for the current operation.
- Add regression tests using writing samples that contain prompt-injection strings and verify that those strings cannot affect later generation.
- Treat uploaded samples, LLM output, saved fingerprints, and