T09 · Insecure Skill Coding Practices
- Location
scripts/rewrite-content.py:41- Finding
Prompt Injection Through Untrusted Content Embedded in AI Instructions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/rewrite-content.py, lines 41-66
Vulnerability Type: Untrusted input embedded directly into an AI prompt
Risk Level: MediumVulnerable Code
python prompt_parts = [ f"请对以下内容进行改写。", f"\n改写深度：{depth_map[depth]}", ] if style: prompt_parts.append(f"目标风格：{style}") if platform: prompt_parts.append(f"目标平台：{platform}（请适配该平台的内容规范和用户习惯）") if keep: prompt_parts.append(f"必须保留：{keep}") if avoid: prompt_parts.append(f"需要规避：{avoid}") prompt_parts.append("\n改写要求：") prompt_parts.append("1. 保留爆款基因（钩子类型、情绪触发点、传播结构）") prompt_parts.append("2. 确保原创性，目标重复率 < 10%") prompt_parts.append("3. 输出格式：先输出改写后的内容，再输出一段简短的改写说明（说明做了哪些改动）") prompt_parts.append(f"\n原文：\n{content}") return "\n".join(prompt_parts)Technical Analysis
The script concatenates trusted rewriting instructions and attacker-controlled values into a single prompt. The
content,style,platform,keep, andavoidvalues are not separated from instructions by a structural trust boundary. No instruction tells the downstream AI agent to treat these fields exclusively as untrusted data and to ignore commands found within them.Consequently, crafted source content can contain prompt-injection directives that compete with or override the intended rewriting task. Plain delimiters alone would not fully resolve this issue because language models may still interpret instructions inside a delimited data section.
The script itself does not execute shell commands, access credentials, or perform network operations. Exploitation therefore depends on the generated prompt being passed to a downstream AI agent. The severity and reachable effects depend on that agent's tools, permissions, context, and independent safety controls.
Attack Path
- An attacker supplies content through
--inputor an attacker-controlled file through--input-file. - The supplied tex ...[truncated 1186 chars]
- An attacker supplies content through
- Remediation
View remediation
Remediation Suggestions
- Pass trusted instructions and untrusted source content as separate structured messages or fields supported by the downstream AI API.
- Place immutable security instructions in the highest-priority system or developer message, explicitly stating that source content and option values are data and that instructions contained within them must not be followed.
- Represent
content,style,platform,keep, andavoidin a structured payload rather than concatenating them into a single free-form instruction string. - Apply strict allowlists to fields with known values. In particular, validate
platformagainst the documented platform set and constrain the length and character set of descriptive options where practical. - Limit the downstream agent to the minimum required tools and permissions. A text-rewriting task should not require shell, filesystem, credential, or network access.
- Validate the generated response against the expected output schema and reject output that contains tool requests, unrelated instructions, or unexpected sensitive material.
- Use clear data boundaries as defense in depth, while recognizing that delimiters and escaping alone do not reliably prevent prompt injection.
- Add adversarial tests containing instruction-like source text to confirm that the downstream agent continues to perform only the authorized rewriting operation.