T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:175
- Finding
- Uncontrolled Transmission of Task Content to a Third-Party AI Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:175-190` **Vulnerability Type**: Uncontrolled external disclosure of potentially sensitive task content **Risk Level**: Medium ### Complete Code Snippet ```python import requests, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def pilot(body: dict) -> dict: r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # LLM reasoning / analysis result = pilot({"type": "chat", "inputs": {"messages": [{"role": "user", "content": "Analyze this data..."}]}, "prefer": "balanced"}) text = result["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The Skill instructs sub-agents to submit an arbitrary request body to `https://api.heybossai.com/v1/pilot`. The request may contain task prompts, user-supplied data, internal context, or content copied from agent inboxes. No controls require data classification, payload minimization, secret detection, redaction, destination approval, or informed user consent before transmission. The bearer API key is being sent to its intended API endpoint, so the code does not independently demonstrate credential theft. The security issue is that task content accompanying the credential can cross the local trust boundary without safeguards. External AI processing may support some research or analysis tasks, but it is not required for the Skill's core orchestration functionality. Native sub-agent reasoning is already part of the declared workflow. Making third-party processing the recommended backend therefore exceeds the minimum privileges needed for basic task decomposition and coordination. ### Attack Path 1. A user asks the orchestrator to process confidential source code, business records, customer information, or another sensitive document. 2. The orchestrator co ...[truncated 1114 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make third-party AI processing disabled by default and explicitly opt-in for each task. 2. Display the destination and a summary of the data to be transmitted before requesting user approval. 3. Prefer native or local processing whenever external processing is not essential. 4. Add secret detection and structured redaction for API keys, passwords, private keys, access tokens, personal data, and confidential identifiers. 5. Minimize request bodies to only the fields and excerpts needed for the operation. 6. Introduce an outbound host allowlist and prohibit user-controlled endpoint substitution or redirects. 7. Reject transmission of files or prompts classified as confidential unless an approved policy explicitly permits it. 8. Document the external provider's retention, training, privacy, and deletion policies. 9. Validate HTTP status codes and response schemas and avoid returning raw third-party error content that could expose request details. 10. Use narrowly scoped API credentials and ensure they are not written to logs, status files, or agent outputs. ]]>