T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/summarize.sh:16
- Finding
- Untrusted Transcript Content Is Passed to an AI Without Prompt Isolation## Vulnerability Details **File Location**: `scripts/summarize.sh`, lines 16–35 **Vulnerability Type**: Indirect prompt injection caused by unsafe handling of untrusted transcript content **Risk Level**: Medium ### Complete Code Snippet ```bash # Transcript'i oku ve özet için hazırla CONTENT=$(cat "$TRANSCRIPT" | head -c 50000) # AI'a gönder (clawdbot veya başka CLI) cat << EOF # Video Özeti ## İçerik Bu transcript'i analiz et ve şunları çıkar: 1. **Ana Konular** (bullet points) 2. **Önemli Noktalar** (key takeaways) 3. **Bahsedilen İsimler/Projeler** 4. **Rakamlar/İstatistikler** (varsa) 5. **Kısa Özet** (3-5 cümle) --- Transcript: $CONTENT EOF ``` The related documentation also recommends sending the transcript directly to an AI agent: ```bash cat outputs/transcript.txt | clawdbot ask "Summarize this video" ``` ### Technical Analysis The transcript is derived from potentially attacker-controlled video or audio. The script interpolates that content verbatim into an AI prompt without establishing an explicit trust boundary between the summarization instructions and the untrusted source material. An attacker can place spoken prompt-injection instructions in a video. Whisper then converts those instructions into transcript text, after which the generated prompt presents them to the AI alongside the legitimate summarization request. The documented direct-pipe command similarly sends the entire untrusted transcript to `clawdbot`. AI prompt delimiters alone do not guarantee isolation. If the receiving agent interprets transcript instructions as commands rather than quoted source data, it may abandon the requested summarization task or attempt operations available through its tools. The practical severity depends on the receiving agent's permissions, enabled tools, accessible context, and confirmation controls. ### Attack Path 1. An attacker publishes or supplies a video containing spoken instructions directed at an AI agent. 2. A user invokes ` ...[truncated 1112 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every transcript as untrusted data, regardless of its source. 2. Add a high-priority instruction stating that text inside the transcript is quoted source material and that any commands, policy statements, or tool requests contained in it must not be followed. 3. Pass the transcript through a structured API field or attachment intended for source documents rather than concatenating it into an instruction string. 4. Use explicit begin/end delimiters and ensure the transcript cannot alter the enclosing prompt structure. Delimiters should supplement, not replace, higher-priority trust instructions. 5. Run transcript summarization in a restricted agent profile with tools, shell access, sensitive context, credentials, memory writes, and external side effects disabled. 6. Require explicit user confirmation before any tool invocation resulting from analysis of transcript content. 7. Update `README.md` and `SKILL.md` to warn that media and transcripts may contain prompt-injection content. Replace the direct `clawdbot ask` examples with a constrained summarization workflow. 8. Consider a two-stage process that first extracts factual content in a tool-free environment and then summarizes only the structured extraction.