T09 · Insecure Skill Coding Practices
- Location
SKILL.md:261- Finding
Undisclosed Transmission of User Content to a Third-Party API
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 261-296
Vulnerability Type: Third-party transmission of potentially sensitive user content without adequate privacy or data-minimization guidance
Risk Level: MediumVulnerable Code
python import requests, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] response = requests.post( "https://api.heybossai.com/v1/pilot", headers={ "Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json" }, json={ "type": "chat", "inputs": { "messages": [ { "role": "system", "content": "You are a critical article writer with sharp analytical voice." }, { "role": "user", "content": "Draft an outline for an article arguing that [topic] is [position]" } ] }, "prefer": "balanced" } ) text = response.json()["result"]["choices"][0]["message"]["content"]The same integration is presented as an installation step in
README.md, lines 18-22:markdown ## Installation via SkillBoss API Hub 1. **Set your API key** as environment variable: `SKILLBOSS_API_KEY=your_key_here` 2. **Call the skill** via SkillBoss API Hub at `https://api.heybossai.com/v1/pilot` 3. **Begin using:** Send a `chat` type request with the skill system prompt and your article requestTechnical Analysis
The example sends the complete
messagespayload tohttps://api.heybossai.com/v1/pilot, including the user's article topic, position, evidence, audience information, or any other context placed in the prompt. It also sendsSKILLBOSS_API_KEYas a bearer credential.The endpoint is explicitly documented and uses HTTPS, so the behavior is not covert exfiltration and the API key is ...[truncated 2857 chars]
- Remediation
View remediation
Remediation Suggestions
-
Make external processing explicitly optional. Present the writing instructions as locally usable and describe the SkillBoss integration as an optional provider example rather than a required installation step.
-
Obtain informed consent. Before showing or invoking the integration, clearly state that prompts will leave the user's environment and identify the destination service.
-
Document data handling. Link to the provider's privacy, retention, deletion, training, and subprocessor policies. Explain whether requests may be routed to additional model providers.
-
Minimize transmitted data. Send only content required for generation. Do not include unrelated conversation history, metadata, files, or environment values.
-
Add redaction guidance. Warn users not to submit secrets, credentials, personal data, regulated information, confidential source material, or proprietary drafts unless organizational policy permits it.
-
Constrain credential scope. Recommend a dedicated, least-privileged API key with limited quota, rotation support, and revocation procedures. Never log the authorization header.
-
Harden request handling. Add a timeout, status validation, bounded response processing, schema checks, and controlled error handling:
python response = requests.post( "https://api.heybossai.com/v1/pilot", headers={ "Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json", }, json=minimized_payload, timeout=30, ) response.raise_for_status() data = response.json() text = data["result"]["choices"][0]["message"]["content"] -
Provide a local alternative. Include instructions for applying the style prompt directly to the user's chosen model without requiring this third-party endpoint.
-