T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.ts:82- Finding
Untrusted GitHub Issue Content Is Returned Directly to the Agent
- Content
View full analysis
Vulnerability Details
File Location:
src/index.ts, lines 82-88
Vulnerability Type: Indirect prompt injection through untrusted external content
Risk Level: Mediumts server.tool( "get_need_detail", { id: z.number() }, async ({ id }: { id: number }) => { const octokit = getOctokit(); const { data } = await octokit.issues.get({ owner: REPO_OWNER, repo: REPO_NAME, issue_number: id }); return { content: [{ type: "text", text: `Title: ${data.title}\nBody:\n${data.body}` }] }; } );Technical Analysis
The
get_need_detailtool retrieves a GitHub issue title and body and returns both verbatim as MCP tool content. GitHub issue content is externally controlled and may contain prompt-like instructions intended to manipulate the consuming Agent.The tool does not:
- Verify that the issue has the expected
pain-pointlabel. - Identify the returned fields as untrusted data.
- Structure or delimit the content to help preserve the instruction/data boundary.
- Warn the Agent not to execute instructions embedded in issue titles or bodies.
The accompanying Agent guidance encourages analysis of retrieved issue content but does not establish a trust boundary for that content. The vulnerability is therefore an indirect prompt-injection channel rather than direct local code execution.
Attack Path
- An attacker creates or modifies an issue in the target GitHub repository.
- The attacker places instruction-like content in the issue title or body, such as requests to ignore prior rules, disclose context, or invoke another available tool.
- A user or Agent calls
get_need_detailwith the attacker-controlled issue ID. - The Skill returns the title and body verbatim in the MCP response.
- A susceptible consuming Agent interprets the untrusted issue content as instructions rather than data.
- The Agent may invoke tools or disclose information within the ...[truncated 610 chars]
- Verify that the issue has the expected
- Remediation
View remediation
Remediation Suggestions
- Verify that the requested issue has the expected
pain-pointlabel before returning it. - Return structured fields rather than one combined free-form text block.
- Clearly delimit and identify the title and body as untrusted external data.
- Add explicit Agent instructions stating that GitHub content must never override system, developer, user, or Skill instructions.
- Require confirmation before taking actions derived from retrieved issue content.
- Where supported by the host, apply prompt-injection detection or content isolation to externally retrieved text.
- Consider returning only the fields necessary for analysis and limiting maximum field lengths.
- Verify that the requested issue has the expected