T09 · Insecure Skill Coding Practices
Warning
- Location
references/pitfalls.md:37- Finding
Unauthenticated Debug Log Ingestion and Disclosure
- Content
View full analysis
200) debugLogs.shift(); res.end(); }); app.get('/api/debug-log', function(req, res) { res.json(debugLogs.slice(-50)); }); ``` ### Technical Analysis The Skill recommends creating debug endpoints that accept arbitrary client-provided log data and disclose recent entries without authentication or authorization. The browser-side handler transmits exception messages, source URLs, and line numbers to the server. Depending on the application, these values may contain internal paths, query-string tokens, identifiers, personal data, or user-controlled content. The corresponding `GET /api/debug-log` endpoint returns the shared log buffer to any caller. The ingestion endpoint also lacks explicit input type and length validation and endpoint-specific rate limiting. Although the array is capped at 200 entries, an attacker can continuously overwrite legitimate diagnostic records, submit oversized entries subject to the application's global body limit, or inject misleading content into the debugging record. This is an insecure example rather than evidence that the Skill itself exfiltrates data to an external attacker. Nevertheless, downstream projects following the recommendation verbatim would expose an avoidable public data and abuse surface that exceeds the minimum privileges r ...[truncated 1171 chars]- Remediation
View remediation