Semantic Kernel Security Guide

Semantic Kernel provides a powerful framework for building AI-driven applications, but its security defaults require careful attention. The framework ships with several built-in security features that developers often overlook:

By default, Semantic Kernel creates isolated kernel instances that prevent cross-function contamination. The framework includes built-in prompt sanitization that strips potentially dangerous characters from user inputs before they reach LLM models. However, these protections are minimal and assume developers will implement additional security layers.

The most significant security gap in Semantic Kernel is its permissive function execution model. Functions registered with the kernel can be called by any prompt without authentication or authorization checks. This means a malicious user could potentially invoke administrative functions, database queries, or file system operations simply by crafting the right prompt.

Semantic Kernel also lacks built-in rate limiting and input validation for function parameters. Without these controls, your API is vulnerable to prompt injection attacks, function enumeration, and resource exhaustion. The framework treats all function calls equally, regardless of the caller's identity or intent.

Developers building Semantic Kernel applications consistently fall into these five security traps:

• Unrestricted Function Registration: Registering sensitive functions like database access or file operations without access controls. Any user who discovers these functions can execute them through prompt injection.
• System Prompt Leakage: Embedding API keys, database credentials, or internal URLs in system prompts. Semantic Kernel's default prompt sanitization doesn't catch all sensitive data patterns.
• Missing Input Validation: Passing raw user prompts directly to functions without validation. This enables prompt injection where attackers manipulate function calls through carefully crafted text.
• Excessive Function Permissions: Granting functions more privileges than needed. A function that only needs read access shouldn't have write permissions, but Semantic Kernel doesn't enforce least privilege by default.
• No Rate Limiting on Function Calls: Allowing unlimited function executions, making your API vulnerable to denial-of-service attacks through rapid function invocation.

Implement these specific changes to secure your Semantic Kernel applications:

// 1. Implement function-level access control
kernel.AddPermissionCheck((functionName, args) => {
    // Check user permissions before allowing function execution
    if (functionName === 'deleteUser' && !user.hasAdminRole) {
        throw new Error('Permission denied');
    }
    return true;
});

// 2. Sanitize system prompts
const safeSystemPrompt = sanitizePrompt(`
You are a helpful assistant. Do not reveal any internal information.
Available functions: ${Object.keys(registeredFunctions).join(', ')}
`);

// 3. Validate function arguments
kernel.AddArgumentValidator((functionName, args) => {
    if (functionName === 'queryDatabase') {
        if (typeof args.query !== 'string' || args.query.length > 1000) {
            throw new Error('Invalid query parameters');
        }
    }
    return true;
});

// 4. Implement rate limiting
const callTracker = new Map();
kernel.AddPreExecutionHook((functionName, args, context) => {
    const userKey = context.userId;
    const calls = callTracker.get(userKey) || 0;
    if (calls > 100) { // 100 calls per minute
        throw new Error('Rate limit exceeded');
    }
    callTracker.set(userKey, calls + 1);
});

// 5. Use middleBrick to scan your Semantic Kernel API
// This catches vulnerabilities you might miss
const middlebrick = require('middlebrick');
const result = await middlebrick.scan('https://yourapi.com');
console.log(`Security Score: ${result.score}/100`);
console.log(result.findings);

Additional hardening steps include: separating development and production prompts, implementing audit logging for all function calls, using environment variables for sensitive data instead of hardcoding, and regularly updating Semantic Kernel to the latest version for security patches.