T09 · Insecure Skill Coding Practices
- Location
SKILL.md:171- Finding
Unrestricted Third-Party Transmission of Complete LLM Messages
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 171–191
Vulnerability Type: Sensitive data exposure through an external API
Risk Level: MediumVulnerable Code
python import requests, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def call_llm(messages, prefer="balanced"): r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "chat", "inputs": {"messages": messages}, "prefer": prefer}, timeout=60, ) return r.json()["result"]["choices"][0]["message"]["content"]Technical Analysis
The example serializes and sends the complete caller-supplied
messagescollection tohttps://api.heybossai.com/v1/pilot. Agent messages may contain proprietary source code, private documents, personal information, credentials, or other sensitive workspace context.The implementation provides no data classification, secret detection, field-level filtering, redaction, destination confirmation, or explicit user-consent step before transmission. It also does not document which data should never be submitted. Although HTTPS protects the request in transit, it does not prevent disclosure to or subsequent processing by the external service.
The API credential is read from its declared environment variable and sent only to the documented HTTPS endpoint. The reviewed material contains no evidence that the credential itself is stolen or sent to an unrelated destination.
This remote model-routing feature is not necessary for the Skill's core prompt-construction, agent-tracking, or local orchestration functionality. Declaring
SKILLBOSS_API_KEYas a required environment variable therefore exceeds the minimum privileges and external-service access necessary for most of the declared functionality.Attack Path
- A user supplies confidential material to an agent, such as source code, in ...[truncated 1455 chars]
- Remediation
View remediation
Remediation Suggestions
- Make third-party model routing explicitly optional rather than foundational to the Skill.
- Remove
SKILLBOSS_API_KEYfrom mandatory environment requirements unless the user enables remote routing. - Obtain informed user consent immediately before sending content externally, clearly identifying:
- The destination hostname
- The exact classes of data being transmitted
- Applicable retention and privacy implications
- Apply data minimization by sending only the fields required for the current task rather than the complete conversation history.
- Add preprocessing that detects and redacts common sensitive values, including API keys, access tokens, private keys, passwords, and connection strings.
- Reject transmission when known credential patterns or prohibited data classifications are detected, unless the user provides an explicit override.
- Provide an allowlist mechanism for approved external destinations and prevent runtime destination substitution.
- Offer a local or directly configured provider path for sensitive workloads.
- Document that users must not submit secrets, regulated data, or confidential workspace content without authorization.
- Add robust response validation and safe error handling without logging request bodies or authorization headers.