T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
Unrestricted Local Reference Ingestion and Unsafe Prompt Composition
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 39–85
Vulnerability Type: Unrestricted local file ingestion and prompt injection
Risk Level: MediumVulnerable Code Snippet
markdown ### 2. Reference Materials (optional) Ask: *"Do you want A and B to reference any local files or folders? (e.g., textbook chapters, lecture notes, theorem references)"* If yes, the user specifies a path (file or folder). Its contents will be included in every spawn prompt sent to both A and B as context/reference material. ## Constraints & Rules ### User-Supplied Constraints The user may supply constraints that must be passed to **both** A and B: - Proof method restrictions: "纯几何" / "综合法" / "不能用向量" / "不能用塞瓦定理" / "解析几何" / "代数法" / "数学归纳法"等 - Tool restrictions: "不能用坐标" / "不能用微积分" / "初等方法"等 - Format requirements: "用 LaTeX" / "用中文" / "step by step"等 These constraints must be included verbatim in every spawn prompt sent to both A and B. ### Spawn A (first attempt) { "mode": "run", "task": "请严格证明以下定理：\n\n[定理陈述]\n\n[参考材料（如有）]\n\n要求：\n[用户约束，逐条列出]\n\n用 LaTeX 格式输出完整证明。" } ### Spawn B (review) { "mode": "run", "task": "请严格审查以下证明。\n\n[证明全文]\n\n[参考材料（如有）]\n\n请逐行检查：\n1. 每一步的推理是否正确？\n2. 有没有逻辑漏洞或循环论证？\n3. 有没有违反用户要求的约束（[约束列表]）？\n4. 整体逻辑链是否完整？\n5. 评价：通过 / 需要修改（说明理由）" }Technical Analysis
The skill allows a user to provide an arbitrary local file or directory path and directs the agent to include its contents in every prompt sent to both subagents. It does not define:
- A workspace-root restriction or path allowlist.
- Canonical-path and symlink validation.
- Sensitive-file or hidden-file exclusions.
- File-type, file-count, or size limits.
- A directory enumeration and approval step.
- A trust boundary separating reference data from executable instructions.
- Instructions requiring subagents to ignore commands embedded in reference material.
The skill also requires user-supplied constraints to be inserted verbatim into subagent prompts. Beca ...[truncated 2387 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict reference materials to explicitly approved files beneath the current project or a dedicated reference directory.
- Resolve every path to its canonical form and reject absolute paths, traversal outside the approved root, and symlinks that escape that root.
- Enumerate resolved files before reading a directory and obtain explicit user confirmation for the final list.
- Reject hidden files, credentials, private keys, environment files, device paths, sockets, binaries, and other sensitive or unsupported file types.
- Enforce limits on file size, aggregate input size, file count, recursion depth, and prompt length.
- Add explicit prompt boundaries that label all reference material as untrusted data. Instruct subagents not to execute or follow instructions found inside theorem statements, constraints, proofs, or references.
- Normalize user constraints into a structured allowlisted schema instead of inserting arbitrary text verbatim into privileged task instructions.
- Place task instructions before and after delimited untrusted content, reiterating that embedded content cannot override system or workflow rules.
- Run proof and review subagents without filesystem, command-execution, or network access unless a specific operation requires it.
- Redact secrets and minimize duplicated content before propagating references into multiple subagent prompts or retry rounds.
- Record which files were read and which sanitized excerpts were supplied to each subagent to support review and incident investigation.