T09 · Insecure Skill Coding Practices
Error
- Location
src/rag2.js:216- Finding
Indirect Prompt Injection Through Retrieved Document Content
- Content
View full analysis
{ return `[${i + 1}] ${r.content}`; }); return { context: contextParts.join(separator), hasResults: true, query, resultsCount: results.resultsCount, citations: results.citations, prompt: this.buildAugmentedPrompt(query, contextParts) }; } /** * Build an augmented prompt */ buildAugmentedPrompt(query, contextParts) { return `Based on the following context, answer the question. Use citations [1], [2], etc. to reference sources. Context: ${contextParts.join('\n\n')} Question: ${query} Answer:`; } ``` ### Technical Analysis The retrieved `r.content` values originate from indexed documents and are inserted verbatim into an instruction-bearing prompt. The prompt does not establish a clear trust boundary between system instructions and retrieved data, nor does it instruct the downstream model to disregard commands found in documents. An attacker who can influence an indexed document can add model-directed instructions such as requests to ignore previous instructions, conceal citations, disclose surrounding context, or invoke tools. If that document is retrieved for a later query, its instructions are placed in the same prompt as the legitimate task. Delimiters alone do not reliably prevent this issue. Security controls must ensure that retrieved documents are treated strictly as untrusted evidence and that downstream tool use remains subject to ...[truncated 1385 chars]- Remediation
View remediation
... ``` This instruction should be placed at the highest available trusted prompt level, not merely adjacent to the retrieved content. ]]>