T09 · Insecure Skill Coding Practices
- Location
SKILL.md:22- Finding
Untrusted Webpage Content Is Processed Without Prompt-Injection Safeguards
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-32
Vulnerability Type: Indirect prompt injection through externally retrieved content
Risk Level: MediumVulnerable Code
markdown **URL review** - The user provides a URL Prefer the following tools to retrieve page content, in order of availability: 1. `mcp__web_reader__webReader` - Web Reader MCP server 2. `mcp__web-reader__webReader` - Alternative name 3. WebSearch to search for page information 4. Ask the user to provide a screenshot directly After extracting the content: - Analyze the page structure, text, and link information - Perform a complete functional reviewThe snippet above is an English translation of the original instructions at the cited location.
Technical Analysis
The workflow retrieves content from an arbitrary user-supplied webpage and places the extracted text into the agent's analysis context. It does not establish a trust boundary between the Skill's instructions and the externally controlled webpage content.
In particular, the workflow does not instruct the agent to:
- Treat webpage text and image-derived text exclusively as untrusted evidence.
- Ignore instructions embedded in reviewed content.
- Reject content asking the agent to change its objective, disclose information, invoke tools, or contact third parties.
- Delimit retrieved content from trusted Skill instructions.
- Require user approval before performing actions outside passive page analysis.
- Restrict URL schemes or private, loopback, link-local, metadata-service, and local-file destinations when these controls are not already enforced by the retrieval provider.
An attacker can therefore place agent-directed instructions in visible text, metadata, accessibility text, or other content extracted by the selected Web Reader. Because the Skill immediately directs the agent to analyze the retrieved material without specifying that em ...[truncated 2092 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit trust-boundary rule stating that all retrieved webpage content, metadata, links, and image-derived text are untrusted data and must never be treated as agent instructions.
- Require the agent to ignore embedded requests to change objectives, override policies, reveal secrets, invoke unrelated tools, modify memory, or communicate with third parties.
- Wrap retrieved material in clearly labeled delimiters and analyze only the content inside those delimiters as evidence.
- Restrict accepted URLs to
httpandhttps. Reject local-file schemes and, unless specifically required, loopback, private-network, link-local, and cloud metadata destinations. - Do not follow links or perform active operations discovered in reviewed content without explicit user confirmation.
- Limit retrieval to the minimum content required for review and apply response-size, redirect, and timeout limits.
- Add a post-retrieval check that identifies prompt-like instructions in external content and flags them as potential injection attempts.
- Enforce least privilege at the runtime level so that review sessions cannot access secrets, local files, persistent memory, or unrelated tools by default.
- Record the original URL and retrieval provenance so conclusions can be traced without granting the content instructional authority.