T09 · Insecure Skill Coding Practices
- Location
scripts/smyx_elderly_hand_tremor_detection_analysis.py:59- Finding
Shared fallback identity permits cross-user access to health-analysis reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_elderly_hand_tremor_detection_analysis.py:59,skills/smyx_common/scripts/util.py:428-470, andskills/smyx_common/scripts/dao.py:486-498
Vulnerability Type: Improper identity isolation and shared fallback authentication
Risk Level: HighComplete Code Snippets
scripts/smyx_elderly_hand_tremor_detection_analysis.py:59:python OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) )skills/smyx_common/scripts/util.py:455-470:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idskills/smyx_common/scripts/util.py:428-450:python @classmethod def get_or_create_default_open_id(cls): from .dao import UserDao, User import uuid user_dao = UserDao() user = user_dao.get_first_default_user( cls.DEFAULT_PREFIX, cls.DEFAULT_USERNAME_LENGTH ) if user and user.username: return user.username for _ in range(10): username = cls.generate_default_open_id() if user_dao.get_by_username(username): continue now = datetime.now() user = User( id=uuid.uuid4().hex, username=username, realname=username, s ...[truncated 3676 chars]- Remediation
View remediation
Remediation Suggestions
-
Preserve the authenticated upstream identity by resolving it unconditionally:
python OpenIdUtil.resolve_current_open_id( args.open_id, use_current=True ) -
In multi-user deployments, reject analysis and history requests when no trustworthy per-user identity is available instead of silently assigning a shared account.
-
Do not use a workspace-wide fallback identity for access to health data. If an anonymous mode is required, create an isolated identity scoped to the invoking principal or session and prohibit history queries for anonymous identities.
-
Partition locally persisted users and credentials by authenticated upstream principal. Avoid selecting the first default user solely by a common username prefix.
-
Enforce authorization server-side. Report-list and report-detail endpoints should derive the principal from validated authentication tokens and verify ownership of every returned record rather than trusting client-supplied usernames.
-
Separate Agent workspace data directories where multiple users cannot be assigned reliable distinct identities.
-
Add integration tests with two upstream identities and verify that:
- Each identity receives distinct credentials.
- An analysis submitted by one identity never appears in the other identity's history.
- Missing identity context causes a safe rejection in multi-user mode.
- A client-supplied username cannot override token-based report ownership.
-