T09 · Insecure Skill Coding Practices
- Location
scripts/review.py:54- Finding
Untrusted document content is passed to a tool-capable Codex agent
- Content
View full analysis
Vulnerability Details
File Location:
scripts/review.py, lines 54–68
Vulnerability Type: Indirect prompt injection across an untrusted document-to-agent boundary
Risk Level: MediumComplete Code Snippet
python prompt = task + "\n<ORIGINAL_SOURCE>\n" + source_text + "\n</ORIGINAL_SOURCE>\n<NOTES>\n" + note_text + "\n</NOTES>\n" receipt.parent.mkdir(parents=True, exist_ok=True) attempts = [] answer = None with tempfile.TemporaryDirectory(prefix="paper-review-") as temporary: result = Path(temporary) / "review.txt" command = [ "codex", "exec", "--skip-git-repo-check", "--ephemeral", "-s", "read-only", "-m", "gpt-6-sol", "-c", "model_reasoning_effort=high", "--output-last-message", str(result), "-" ] try: code, stdout, stderr = run(command, prompt, temporary, codex_timeout, os.environ.copy())Technical Analysis
The script concatenates the complete contents of the source paper and notes into a natural-language prompt and submits that prompt to
codex exec. Source papers can originate from external publishers or other untrusted content providers.The preceding task text tells Codex that the documents are untrusted and instructs it not to use tools. However, this restriction is enforced only through natural-language instructions. The subprocess is still a Codex agent invocation, and the selected
read-onlysandbox limits writes rather than technically disabling command tools or all reads.The subprocess also inherits the parent process's complete environment through
os.environ.copy(). Consequently, if adversarial document text successfully overrides or confuses the prompt-level instructions, the resulting agent execution may attempt to inspect readable local data or inherited environment variables. Any retrieved information could then be incorporated into the review returned through--output-last-message.The issue does not demonstrate malicious intent by the Skill aut ...[truncated 1709 chars]
- Remediation
View remediation
Remediation Suggestions
- Invoke the reviewer in a mode that technically disables shell, file, network, and other command tools rather than relying solely on prompt instructions.
- Run the reviewer inside a dedicated container or equivalent operating-system sandbox that exposes only copied source and notes files.
- Replace
os.environ.copy()with a minimal allowlisted environment containing only variables required to launch Codex. Explicitly exclude credentials, tokens, proxy secrets, and unrelated application configuration. - Deny outbound network access for the review subprocess unless it is strictly required.
- Continue treating papers and notes as untrusted data, but add structural isolation where supported, such as a data-only attachment mechanism rather than direct prompt concatenation.
- Treat generated reviews as untrusted output. Inspect them for unexpected secret-like values or irrelevant system information before storing, publishing, or incorporating them into persistent notes.
- Add regression tests using prompt-injection documents that request environment inspection, local file access, tool execution, or instruction override, and verify that these operations are technically unavailable.