T09 · Insecure Skill Coding Practices
Warning
- Location
- src/index.ts:82
- Finding
- Untrusted GitHub Issue Content Is Returned Directly to the Agent## Vulnerability Details **File Location**: `src/index.ts`, lines 82-88 **Vulnerability Type**: Indirect prompt injection through untrusted external content **Risk Level**: Medium ```ts server.tool( "get_need_detail", { id: z.number() }, async ({ id }: { id: number }) => { const octokit = getOctokit(); const { data } = await octokit.issues.get({ owner: REPO_OWNER, repo: REPO_NAME, issue_number: id }); return { content: [{ type: "text", text: `Title: ${data.title}\nBody:\n${data.body}` }] }; } ); ``` ### Technical Analysis The `get_need_detail` tool retrieves a GitHub issue title and body and returns both verbatim as MCP tool content. GitHub issue content is externally controlled and may contain prompt-like instructions intended to manipulate the consuming Agent. The tool does not: - Verify that the issue has the expected `pain-point` label. - Identify the returned fields as untrusted data. - Structure or delimit the content to help preserve the instruction/data boundary. - Warn the Agent not to execute instructions embedded in issue titles or bodies. The accompanying Agent guidance encourages analysis of retrieved issue content but does not establish a trust boundary for that content. The vulnerability is therefore an indirect prompt-injection channel rather than direct local code execution. ### Attack Path 1. An attacker creates or modifies an issue in the target GitHub repository. 2. The attacker places instruction-like content in the issue title or body, such as requests to ignore prior rules, disclose context, or invoke another available tool. 3. A user or Agent calls `get_need_detail` with the attacker-controlled issue ID. 4. The Skill returns the title and body verbatim in the MCP response. 5. A susceptible consuming Agent interprets the untrusted issue content as instructions rather than data. 6. The Agent may invoke tools or disclose information within the ...[truncated 610 chars]
- Remediation
- ## Remediation Suggestions 1. Verify that the requested issue has the expected `pain-point` label before returning it. 2. Return structured fields rather than one combined free-form text block. 3. Clearly delimit and identify the title and body as untrusted external data. 4. Add explicit Agent instructions stating that GitHub content must never override system, developer, user, or Skill instructions. 5. Require confirmation before taking actions derived from retrieved issue content. 6. Where supported by the host, apply prompt-injection detection or content isolation to externally retrieved text. 7. Consider returning only the fields necessary for analysis and limiting maximum field lengths.