T09 · Insecure Skill Coding Practices
- Location
SKILL.md:70- Finding
Untrusted Remote Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 70-72
Vulnerability Type: Untrusted content processing and indirect prompt injection
Risk Level: MediumVulnerable Code:
markdown 1. Fetch content from all reference URLs (use web_fetch tool) 2. For Twitter/X URLs, transform to FxTwitter API: `https://api.fxtwitter.com/username/status/123456` 3. Analyze each piece following the `references/content-deconstructor.md` guideTechnical Analysis
The workflow retrieves content from user-selected remote URLs and passes that content directly into an agent-driven analysis pipeline. It does not instruct the agent to treat retrieved text as untrusted data, ignore instructions embedded in the content, or separate remote content from executable prompt instructions.
A malicious page can include visible or concealed prompt-injection directives. When the agent analyzes that page, those directives could be interpreted as instructions rather than source material. The resulting manipulation could propagate into the content breakdown, anatomy guide, meta-prompt, and final drafts.
This issue is classified as insecure skill design rather than confirmed intentional instruction hijacking because the Skill itself does not contain a malicious override. It instead creates an exploitable trust-boundary failure when processing remote content.
Attack Path
- An attacker publishes reference content containing embedded instructions directed at an AI agent.
- The attacker persuades a user to submit the malicious page as a reference URL, or the user independently selects the compromised page.
- The Skill retrieves the page through
web_fetch. - The retrieved text is placed into the agent's analysis context without instruction isolation.
- The agent may follow embedded directives while generating the breakdown or later artifacts.
- Attacker-controlled instructions may alter generated prompts, drafts, or subs ...[truncated 639 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly state that all remotely retrieved content is untrusted data and must never be treated as agent instructions.
- Place fetched content inside clearly delimited data blocks and instruct the agent to analyze only its subject matter and writing characteristics.
- Reject or neutralize content that attempts to address the agent, change its role, request tool calls, disclose context, or override prior instructions.
- Extract only the article body or required post fields rather than forwarding complete HTML, metadata, comments, scripts, or hidden elements.
- Ensure generated meta-prompts cannot inherit instructions quoted from reference material.
- Require explicit user confirmation before performing any additional action suggested by remotely retrieved content.
- Add an output validation step that checks generated artifacts for injected directives, secret requests, unrelated tool instructions, or role overrides.