T09 · Insecure Skill Coding Practices
- Location
SKILL.md:38- Finding
Untrusted Community Content Can Manipulate Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:38-39, 55-64and identical duplicateskill/SKILL.md:38-39, 55-64
Vulnerability Type: Prompt injection through untrusted external content
Risk Level: MediumRelevant code segment, translated into English from the source:
text Input format: Reddit and forum data collected by Agent-Reach in JSONL or Markdown, including titles, bodies, and comments. A batch of popular post titles and comment summaries may also be pasted manually. Input: Reddit and forum data collected by Agent-Reach in JSONL or Markdown, including titles, bodies, and comments, or manually pasted post titles and comment summaries. Weekly Top Five Topics: - Estimate the approximate number of posts when an exact count is unavailable. - Provide representative examples by quoting real post titles.The relevant source does not establish a trust boundary between the Skill's governing instructions and the imported post titles, bodies, comments, or manually pasted text.
Technical Analysis
The Skill processes content collected from Reddit and external forums, as well as arbitrary text pasted by a user. These data sources are attacker-controlled and may contain natural-language instructions such as requests to ignore the Skill prompt, alter compliance constraints, fabricate conclusions, or reproduce unrelated content.
The System Prompt does not instruct the model to:
- Treat imported records exclusively as untrusted data.
- Ignore commands, role declarations, or policy statements embedded in records.
- Place records inside explicit and reliably identifiable data delimiters.
- Validate each input against a restricted schema.
- Prevent imported content from overriding compliance and output requirements.
- Safely quote or neutralize adversarial text copied from source titles.
The requirement to quote real post titles further increases the possibility that adversarial te ...[truncated 1748 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit trust-boundary rule to the System Prompt stating that all post titles, bodies, comments, metadata, links, and manually pasted records are untrusted data and never instructions.
- Require the model to ignore any role declarations, commands, requests to reveal context, policy changes, output-format changes, or compliance overrides found inside imported records.
- Wrap imported records in explicit data delimiters and state that content inside those delimiters may only be classified, summarized, counted, and quoted safely.
- Parse data into a restricted schema containing fields such as source, title, body, comments, score, and timestamp. Reject or flag malformed records rather than placing arbitrary text into the prompt.
- Add a rule that quoted titles must be treated as inert text. Escape or truncate titles containing instruction-like language, markup, or control tokens.
- Require every generated claim, count, quotation, and trend conclusion to be traceable to one or more source records. Clearly label estimates and avoid inventing missing data.
- Place compliance requirements after the untrusted data or otherwise ensure they remain authoritative, and explicitly state that source content cannot modify them.
- Add adversarial tests containing instructions such as attempts to override the report format, suppress safety warnings, reveal hidden prompts, or inject downstream instructions.
- Apply the same corrections to both
SKILL.mdandskill/SKILL.mdso the root copy and the importable copy cannot diverge. - Before passing generated topics to downstream Skills, review or filter the output for copied instructions, unsupported claims, unsafe repair advice, and omitted compliance notices.