T09 · Insecure Skill Coding Practices
- Location
SKILL.md:83- Finding
Untrusted Remote Content Is Incorporated into Generated Skills Without Trust Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 83-98
Vulnerability Type: Indirect prompt injection through untrusted advisory and patch content
Risk Level: MediumVulnerable Code Snippet
markdown 1. 读 `description` 提取漏洞根因和攻击路径 2. 如果有 `patch_urls`，用 `gh api repos/{owner}/{repo}/commits/{sha} -H "Accept: application/vnd.github.diff"` 获取 diff 3. 从 description + diff 中提取结构化信息： - **Source**: 用户输入的具体入口 - **Sink**: 触发危害的具体函数 - **Sanitization Gap**: 为什么 source→sink 路径上没有有效防护 - **漏洞代码**: 关键的危险代码模式 - **为什么扫描器会漏掉**: CodeQL/Bandit/Gosec 漏检的具体原因 - **检测方法**: 如何在未知代码中发现此类漏洞The same unsafe trust model is also applied to HackerOne and NVD content at
SKILL.md, lines 270-277:markdown 1. 从 `hacktivity_summary` + `nvd_description` 提取漏洞根因和攻击路径 2. 归纳 Detection Strategy（Sources → Sinks → Sanitization） 3. 写入 `vuln-skills/skills/pentest-{category}/SKILL.md` + `references/cases.md` **H1 数据特点（与 GHSA 的区别）：** - H1 报告通常包含更详细的攻击步骤和 PoC - `hacktivity_summary` 是 AI 生成的摘要，可能不完整，需结合 NVD 描述Technical Analysis
The workflow directs an AI agent to retrieve and interpret externally controlled advisory descriptions, repository diffs, HackerOne summaries, and NVD descriptions. It then uses the extracted material to generate persistent downstream
SKILL.mdfiles.These sources must be treated as untrusted data. The documented workflow does not instruct the agent to:
- Ignore instructions embedded in fetched reports, source comments, commit messages, or patches.
- Separate remote evidence from trusted task instructions.
- Validate extracted claims against independent sources.
- Restrict generated files to an allowlisted schema.
- Review generated Skill text for prompt injection or unrelated directives.
Consequently, instruction-like text in a remote advisory or patch could be interpreted as an agent directive rather than inert evidence. Because generated Skills may ...[truncated 1519 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly label all advisory descriptions, patches, reports, commit content, and scraped pages as untrusted data.
- Add a mandatory instruction that the agent must never follow commands or behavioral directives found inside remote content.
- Place fetched content inside clearly delimited data blocks and process it only as evidence.
- Extract findings into a strict schema containing allowlisted fields such as source, sink, sanitization gap, affected file, and verified identifiers.
- Reject generated content that introduces unrelated instructions, tool calls, plugin installation requests, external callbacks, or changes to agent behavior.
- Independently verify important claims against the original advisory, patch, and authoritative vulnerability records.
- Run a post-generation security review that scans generated Skills for prompt-injection phrases, instruction overrides, hidden content, unexpected links, and executable commands.
- Require human approval before generated Skills are installed or used in future agent sessions.