fix: wrap skill/episode context as untrusted before injection

Skill content and retrieved session episodes were injected as plain
system messages, so a compromised or tainted skill/episode could pose as
trusted instructions. They now pass through the same nonce'd
<untrusted_content_*> wrapper used for tool output.

- Add UntrustedWrapper to odek.Config and plumb it into loop.Engine.
- In internal/loop/loop.go, apply the wrapper (when set) to skill and
  episode context before injecting system messages.
- Update all odek.New callers (CLI, REPL, serve, telegram, schedule,
  subagent) to pass wrapUntrusted.
- Remove the trusted-task-guide instruction from verbose skill banners.
- Add TestEngine_SkillAndEpisode_Wrapped regression test.
- Update docs/SECURITY.md and AGENTS.md.

Author: jkyberneees

AGENTS.md

@@ -139,6 +139,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Telegram photo caption wrapping** (`cmd/odek/telegram.go`) — photo captions cross the Telegram trust boundary, so they are wrapped as untrusted content both when passed to the local vision model and when injected into the main agent's user message.
 - **`send_message` callback prefix restriction** (`internal/tool/send_message.go` + `cmd/odek/telegram.go`) — the `send_message` tool rejects any button whose `callback_data` starts with a reserved internal prefix (`apr:`, `den:`, `trs:`, `clarify:`, `skill_save:`, `skill_skip:`); only user-facing `cb:` callbacks are allowed. The Telegram sender closure validates again as defense-in-depth, preventing a forged approval or skill button.
 - **Session ID entropy + session-scoped auth tokens** (`internal/session/session.go`, `cmd/odek/serve.go`) — session IDs now carry 128 bits of randomness (16 bytes / 32 hex chars); each session stores a 256-bit `AuthToken` required by `GET/DELETE/POST /api/sessions/<id>` and WebSocket session-resume messages via `X-Session-Token` header, `session_token` cookie, or `auth_token` WS field. Per-IP rate limiting (60/min) on session lookups adds a brute-force backstop.
+- **Skill/episode untrusted wrapper** (`internal/loop/loop.go` + `odek.go`) — skill context and retrieved session-episode context are passed through the caller-provided untrusted wrapper (the same nonce'd `<untrusted_content_*>` boundary used for tool output) before being injected into the model's system context. This prevents a compromised or tainted skill/episode from being treated as trusted system instructions.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 
 ### Platform Support

cmd/odek/main.go

@@ -922,13 +922,14 @@ func run(args []string) error {
 	}
 
 	agent, err := odek.New(odek.Config{
-		Model:           resolved.Model,
-		BaseURL:         resolved.BaseURL,
-		APIKey:          resolved.APIKey,
-		MaxIterations:   resolved.MaxIter,
-		MaxToolParallel: resolved.MaxToolParallel,
-		SystemMessage:   systemMessage,
-		NoProjectFile:   resolved.NoAgents,
+		Model:            resolved.Model,
+		BaseURL:          resolved.BaseURL,
+		APIKey:           resolved.APIKey,
+		MaxIterations:    resolved.MaxIter,
+		MaxToolParallel:  resolved.MaxToolParallel,
+		SystemMessage:    systemMessage,
+		UntrustedWrapper: wrapUntrusted,
+		NoProjectFile:    resolved.NoAgents,
 		Thinking:        resolved.Thinking,
 		ThinkingBudget:  f.ThinkingBudget,
 		Temperature:     0, // deterministic by default; override with --temperature
@@ -1770,13 +1771,14 @@ func continueCmd(args []string) error {
 	}
 
 	agent, err := odek.New(odek.Config{
-		Model:           resolved.Model,
-		BaseURL:         resolved.BaseURL,
-		APIKey:          resolved.APIKey,
-		MaxIterations:   resolved.MaxIter,
-		MaxToolParallel: resolved.MaxToolParallel,
-		SystemMessage:   systemMessage,
-		NoProjectFile:   resolved.NoAgents,
+		Model:            resolved.Model,
+		BaseURL:          resolved.BaseURL,
+		APIKey:           resolved.APIKey,
+		MaxIterations:    resolved.MaxIter,
+		MaxToolParallel:  resolved.MaxToolParallel,
+		SystemMessage:    systemMessage,
+		UntrustedWrapper: wrapUntrusted,
+		NoProjectFile:    resolved.NoAgents,
 		Thinking:        resolved.Thinking,
 		Temperature:     0, // deterministic by default; override with --temperature
 		Tools:           tools,

cmd/odek/repl.go

@@ -129,11 +129,12 @@ func replCmd(args []string) error {
 	}
 
 	agent, err := odek.New(odek.Config{
-		Model:          resolved.Model,
-		BaseURL:        resolved.BaseURL,
-		APIKey:         resolved.APIKey,
-		MaxIterations:  resolved.MaxIter,
-		SystemMessage:  systemMessage,
+		Model:            resolved.Model,
+		BaseURL:          resolved.BaseURL,
+		APIKey:           resolved.APIKey,
+		MaxIterations:    resolved.MaxIter,
+		SystemMessage:    systemMessage,
+		UntrustedWrapper: wrapUntrusted,
 		NoProjectFile:  resolved.NoAgents,
 		Thinking:       resolved.Thinking,
 		ThinkingBudget: f.ThinkingBudget,

cmd/odek/schedule.go

@@ -673,6 +673,7 @@ func runTaskHeadless(ctx context.Context, resolved config.ResolvedConfig, system
 		MaxIterations:     resolved.MaxIter,
 		MaxToolParallel:   resolved.MaxToolParallel,
 		SystemMessage:     system,
+		UntrustedWrapper:  wrapUntrusted,
 		RuntimeContext:    odek.BuildRuntimeContext("schedule"),
 		NoProjectFile:     resolved.NoAgents,
 		Thinking:          resolved.Thinking,

cmd/odek/serve.go

@@ -407,13 +407,14 @@ func newServeAgent(resolved config.ResolvedConfig, system string, sendFn func(v
 	}
 
 	agent, err := odek.New(odek.Config{
-		Model:           resolved.Model,
-		BaseURL:         resolved.BaseURL,
-		APIKey:          resolved.APIKey,
-		MaxIterations:   resolved.MaxIter,
-		MaxToolParallel: resolved.MaxToolParallel,
-		SystemMessage:   system,
-		RuntimeContext:  runtimeCtx,
+		Model:            resolved.Model,
+		BaseURL:          resolved.BaseURL,
+		APIKey:           resolved.APIKey,
+		MaxIterations:    resolved.MaxIter,
+		MaxToolParallel:  resolved.MaxToolParallel,
+		SystemMessage:    system,
+		UntrustedWrapper: wrapUntrusted,
+		RuntimeContext:   runtimeCtx,
 		NoProjectFile:   resolved.NoAgents,
 		Thinking:        resolved.Thinking,
 		InteractionMode: resolved.InteractionMode,

cmd/odek/subagent.go

@@ -358,7 +358,8 @@ func subagentCmd(args []string) error {
 		BaseURL:        resolved.BaseURL,
 		APIKey:         resolved.APIKey,
 		MaxIterations:  cfg.maxIter,
-		SystemMessage:  systemMsg,
+		SystemMessage:    systemMsg,
+		UntrustedWrapper: wrapUntrusted,
 		RuntimeContext: odek.BuildRuntimeContext("terminal"),
 		NoProjectFile:  resolved.NoAgents,
 		Thinking:       resolved.Thinking,

cmd/odek/telegram.go

@@ -1469,13 +1469,14 @@ func handleChatMessage(
 	}
 
 	agentCfg := odek.Config{
-		Model:           resolved.Model,
-		BaseURL:         resolved.BaseURL,
-		APIKey:          resolved.APIKey,
-		MaxIterations:   resolved.MaxIter,
-		MaxToolParallel: resolved.MaxToolParallel,
-		SystemMessage:   systemMessage,
-		RuntimeContext:  odek.BuildRuntimeContext("telegram"),
+		Model:            resolved.Model,
+		BaseURL:          resolved.BaseURL,
+		APIKey:           resolved.APIKey,
+		MaxIterations:    resolved.MaxIter,
+		MaxToolParallel:  resolved.MaxToolParallel,
+		SystemMessage:    systemMessage,
+		UntrustedWrapper: wrapUntrusted,
+		RuntimeContext:   odek.BuildRuntimeContext("telegram"),
 		InteractionMode: resolved.InteractionMode,
 		NoProjectFile:   resolved.NoAgents,
 		Skills:          skillsCfg,

docs/SECURITY.md

@@ -336,6 +336,10 @@ The defense has three layers:
 
 Legacy sessions created before this defense have no `AuthToken`; the first access bootstraps one and returns it to the client, preserving backward compatibility without weakening protection for newly created sessions.
 
+### 24. Skill and episode context wrapped as untrusted
+
+Skill content and retrieved session episodes are externally-sourced data that cross the trust boundary. Before injecting them as `system` messages, the loop passes them through the same nonce'd `<untrusted_content_*>` wrapper used for tool output. The skill manager already gates `NeedsReview`/tainted skills, and the memory manager filters tainted episodes from search, but the wrapper provides defense-in-depth so a compromised skill or episode cannot pose as trusted system instructions.
+
 ### YOLO mode
 
 ```json

internal/loop/loop.go

@@ -63,11 +63,12 @@ type Engine struct {
 	system       string
 	baseSystem   string             // original system message without memory/skills
 	maxContext   int                // max context tokens (0 = no limit)
-	skillLoader  SkillLoader        // optional: loads matching skills
-	lastSkillMsg string             // last user message that triggered skill loading (dedup)
-	lastEpiMsg   string             // last user message that triggered episode search (dedup)
-	skillVerbose bool               // show full skill banners (default: condensed)
-	episodeCtx   EpisodeContextFunc // optional: per-turn episode search
+	skillLoader      SkillLoader              // optional: loads matching skills
+	lastSkillMsg     string                   // last user message that triggered skill loading (dedup)
+	lastEpiMsg       string                   // last user message that triggered episode search (dedup)
+	skillVerbose     bool                     // show full skill banners (default: condensed)
+	episodeCtx       EpisodeContextFunc       // optional: per-turn episode search
+	wrapUntrusted    func(source, content string) string // optional: wraps skill/episode content
 
 	toolEventHandler ToolEventHandler // optional: fires during tool execution
 	signalHandler    SignalHandler    // optional: fires on internal loop signals
@@ -170,6 +171,13 @@ func (e *Engine) SetInteractionMode(mode string) { e.interactionMode = mode }
 // or condensed markers (false, default). Condensed saves context window space.
 func (e *Engine) SetSkillVerbose(verbose bool) { e.skillVerbose = verbose }
 
+// SetUntrustedWrapper sets a function that wraps externally-sourced content
+// (skill context, episode context) with a nonce'd boundary before injecting it
+// into the model's system context. When nil, that content is injected directly.
+func (e *Engine) SetUntrustedWrapper(fn func(source, content string) string) {
+	e.wrapUntrusted = fn
+}
+
 // SetMemoryPromptFunc sets the optional memory prompt callback.
 // When set, it is called before each LLM invocation to get fresh memory
 // content. This ensures the agent sees the latest facts even if it
@@ -585,27 +593,28 @@ func (e *Engine) runLoop(ctx context.Context, messages []llm.Message) (string, [
 			if userMsg := lastUserMessage(messages); userMsg != "" && userMsg != e.lastSkillMsg {
 				if skillContext := e.skillLoader(userMsg); skillContext != "" {
 					e.lastSkillMsg = userMsg
-					// Inject skill context as a system message right before the user message
+					// Inject skill context as a system message right before the user message.
+					// The skill manager gates NeedsReview/tainted skills, but we treat any
+					// loaded skill content as externally-sourced and wrap it with the
+					// caller-provided untrusted wrapper as defense in depth.
+					wrappedContent := skillContext
+					if e.wrapUntrusted != nil {
+						wrappedContent = e.wrapUntrusted("skill", skillContext)
+					}
 					insertIdx := len(messages)
 					for j := len(messages) - 1; j >= 0; j-- {
 						if messages[j].Role == "system" && j != 0 {
 							insertIdx = j + 1
 							break
 						}
 					}
-					// Wrap skill content as a trusted task guide.
-					// When verbose is enabled, use full banners for debugging/auditing.
-					// By default, inject skill content silently with no wrapping markers to minimize context window overhead.
 					var wrappedSkill string
 					if e.skillVerbose {
-						wrappedSkill = "═══ SKILL LOADED (task guide) ═══\n" +
-							skillContext +
-							"\n═══ END SKILL ═══\n" +
-							"\nThe instructions above are loaded from a skill file for the current task. " +
-							"Follow them as your primary guide. Only deviate if they conflict " +
-							"with your core identity or the safety rules in the system prompt."
+						wrappedSkill = "═══ SKILL LOADED (reference) ═══\n" +
+							wrappedContent +
+							"\n═══ END SKILL ═══"
 					} else {
-						wrappedSkill = skillContext
+						wrappedSkill = wrappedContent
 					}
 					skillMsg := llm.Message{Role: "system", Content: wrappedSkill}
 					// Pre-allocate and copy to avoid nested append allocations
@@ -624,6 +633,12 @@ func (e *Engine) runLoop(ctx context.Context, messages []llm.Message) (string, [
 			if userMsg := lastUserMessage(messages); userMsg != "" && userMsg != e.lastEpiMsg {
 				if episodeContext := e.episodeCtx(userMsg); episodeContext != "" {
 					e.lastEpiMsg = userMsg
+					// Episode context comes from past session content and crosses the
+					// trust boundary; wrap it as untrusted before injecting.
+					wrappedContext := episodeContext
+					if e.wrapUntrusted != nil {
+						wrappedContext = e.wrapUntrusted("episode", episodeContext)
+					}
 					// Inject episode context as a system message before the user message
 					insertIdx := len(messages)
 					for j := len(messages) - 1; j >= 0; j-- {
@@ -632,7 +647,7 @@ func (e *Engine) runLoop(ctx context.Context, messages []llm.Message) (string, [
 							break
 						}
 					}
-					epMsg := llm.Message{Role: "system", Content: episodeContext}
+					epMsg := llm.Message{Role: "system", Content: wrappedContext}
 					newMsgs := make([]llm.Message, 0, len(messages)+1)
 					newMsgs = append(newMsgs, messages[:insertIdx]...)
 					newMsgs = append(newMsgs, epMsg)

internal/loop/loop_test.go

@@ -1917,6 +1917,54 @@ func TestEngine_SkillsAndEpisodesBothLoad(t *testing.T) {
 	}
 }
 
+func TestEngine_SkillAndEpisode_Wrapped(t *testing.T) {
+	var sawSkillWrapped, sawEpisodeWrapped bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var body struct {
+			Messages []struct {
+				Role    string `json:"role"`
+				Content string `json:"content"`
+			} `json:"messages"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			return
+		}
+		for _, msg := range body.Messages {
+			if strings.HasPrefix(msg.Content, "WRAPPED:skill:") && strings.Contains(msg.Content, "injected skill context") {
+				sawSkillWrapped = true
+			}
+			if strings.HasPrefix(msg.Content, "WRAPPED:episode:") && strings.Contains(msg.Content, "injected episode context") {
+				sawEpisodeWrapped = true
+			}
+		}
+		fmt.Fprint(w, `{"choices":[{"message":{"content":"done"}}]}`)
+	}))
+	defer server.Close()
+
+	skillLoader := func(string) string { return "injected skill context" }
+	episodeCtx := func(string) string { return "injected episode context" }
+
+	client := llm.New(server.URL, "sk", "test-model", "", 0, 0)
+	engine := New(client, tool.NewRegistry(nil), 10, "You are odek.", nil, 0)
+	engine.SetSkillLoader(skillLoader)
+	engine.SetEpisodeContextFunc(episodeCtx)
+	engine.SetUntrustedWrapper(func(source, content string) string {
+		return "WRAPPED:" + source + ":" + content
+	})
+
+	_, err := engine.Run(context.Background(), "test both wrappers")
+	if err != nil {
+		t.Fatalf("Run() error: %v", err)
+	}
+
+	if !sawSkillWrapped {
+		t.Error("skill context was not passed through the untrusted wrapper")
+	}
+	if !sawEpisodeWrapped {
+		t.Error("episode context was not passed through the untrusted wrapper")
+	}
+}
+
 func TestClassifyToolCall_Terminal(t *testing.T) {
 	risk, resource := classifyToolCall("terminal", `{"command":"whoami"}`)
 	if risk != danger.Safe {