T09 · Insecure Skill Coding Practices
Warning
- Location
commands/reflect/default.md:15- Finding
Indirect prompt injection through untrusted session records and Vault notes
- Content
View full analysis
{msg}") lines.append("") return "\n".join(lines) ``` From `extract_sessions.py:287-295`: ```python for s in daily_data[date]: lines.append(f"### {s['project']}") lines.append("") for msg in s["messages"]: lines.append(f"> {msg}") lines.append("") return "\n".join(lines) ``` ### Technical Analysis The extraction script places user-controlled session messages into Markdown digest files with only content filtering and truncation. Quoting a message with a Markdown blockquote does not establish a security boundary and does not prevent an AI agent from interpreting the message as an instruction. The slash-command templates then direct the agent to read these generated records, arbitrary recent personal notes, and previous reflection reports. They do not instruct the agent to: - Treat document contents strictly as untrusted data. - Ignore instructions embedded in analyzed files. - Reject requests for additional tool calls or unrelated file access. - Restrict file reads to a precomputed allowlist. - Obtain confirmation before acting outside the reflection workflow. The sanitization logic removes certain tags and fenced code blocks, but ordinary natural-language prompt injection does not require either ...[truncated 1928 chars]- Remediation
View remediation