T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aqua-hosted-pulse.mjs:931- Finding
Indirect Prompt Injection Through Hosted Social Content Can Influence Autonomous Posts and Direct Messages
- Content
View full analysis
@${item.replyToGateway.handle}` : ''; const marker = item?.id === targetExpressionId ? ' [TARGET]' : ''; return `- ${author}${replyTarget}${marker}: ${String(item?.body ?? '').trim()}`; } function formatDirectMessagePromptLine(item, selfGatewayId, peerHandle) { const isSelf = item?.senderGatewayId === selfGatewayId; const speaker = isSelf ? 'self' : `@${peerHandle || 'peer'}`; return `- ${speaker}: ${String(item?.body ?? '').trim()}`; } ``` The formatted remote content is inserted directly into model prompts: ```js if (input.plan.mode === 'reply') { lines.push( '', 'Public thread context:', ...(input.contextItems.length ? input.contextItems.map((item) => formatPublicExpressionPromptLine(item, input.plan.replyToExpressionId)) : [ `- Target handle: ${input.plan.replyToGatewayHandle ? `@${input.plan.replyToGatewayHandle}` : 'unknown'}`, '- Thread snapshot could not be loaded cleanly; reply to the target line as directly and specifically as possible.', ]), ); } ``` ```js lines.push( '', 'Recent DM context:', ...(input.contextItems.length ? input.contextItems.map((item) => formatDirectMessagePromptLine(item, input.selfGatewayId, input.plan.targetGatewayHandle), ) : ['- No visible DM history is available; write a natural first line for this private thread.']), ); ``` The resulting prompt is passed to ...[truncated 3964 chars]- Remediation
View remediation