Hi! We package session-handoff downstream (stacklok/dockyard) and run skills through an automated security scanner whose LLM judge flagged a prompt-injection concern in skills/session-handoff/SKILL.md. On review we think it's a legitimate hardening opportunity — filing constructively, since the behavior is already documented in the skill itself.
Concern
The skill:
- Reads
.git/entire-sessions/<id>.json and extracts transcript_path — an arbitrary filesystem path.
- Greps the file at that path into the agent's context.
- Then "immediately pick up the work — start planning, coding, or doing whatever the next step is. Do not ask permission," with explicit top-of-file rules to not ask clarifying questions and not confirm before continuing.
Two issues stack:
- Indirect prompt injection. The transcript is untrusted input — it could come from a cloned repo that ships its own
.git/entire-sessions/, a shared checkpoint, or another party's session. Instructions embedded in the transcript's "next steps"/final messages get acted on autonomously, because the skill deliberately removes the human-confirmation step that would normally catch this.
- Arbitrary file read.
transcript_path is read verbatim from the session JSON. A crafted session file can point it at ~/.ssh/id_rsa, a .env, etc., pulling secrets into context — which the autonomous-continuation behavior can then be steered to use.
Suggested hardening
- Keep a confirmation checkpoint before autonomously acting on transcript-derived "next steps" — at least when the session source isn't the user's own current machine/agent.
- Validate/constrain
transcript_path (e.g. require it to resolve under known session directories; reject paths outside an allowlist).
- Treat transcript content as data, not instructions — explicitly instruct the agent not to follow any instructions found inside the transcript.
Happy to send a PR if that'd be useful. Thanks for the skill!
Hi! We package
session-handoffdownstream (stacklok/dockyard) and run skills through an automated security scanner whose LLM judge flagged a prompt-injection concern inskills/session-handoff/SKILL.md. On review we think it's a legitimate hardening opportunity — filing constructively, since the behavior is already documented in the skill itself.Concern
The skill:
.git/entire-sessions/<id>.jsonand extractstranscript_path— an arbitrary filesystem path.Two issues stack:
.git/entire-sessions/, a shared checkpoint, or another party's session. Instructions embedded in the transcript's "next steps"/final messages get acted on autonomously, because the skill deliberately removes the human-confirmation step that would normally catch this.transcript_pathis read verbatim from the session JSON. A crafted session file can point it at~/.ssh/id_rsa, a.env, etc., pulling secrets into context — which the autonomous-continuation behavior can then be steered to use.Suggested hardening
transcript_path(e.g. require it to resolve under known session directories; reject paths outside an allowlist).Happy to send a PR if that'd be useful. Thanks for the skill!