T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:175- Finding
Uncontrolled Transmission of Task Content to a Third-Party AI Service
- Content
View full analysis
dict: r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # LLM reasoning / analysis result = pilot({"type": "chat", "inputs": {"messages": [{"role": "user", "content": "Analyze this data..."}]}, "prefer": "balanced"}) text = result["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The Skill instructs sub-agents to submit an arbitrary request body to `https://api.heybossai.com/v1/pilot`. The request may contain task prompts, user-supplied data, internal context, or content copied from agent inboxes. No controls require data classification, payload minimization, secret detection, redaction, destination approval, or informed user consent before transmission. The bearer API key is being sent to its intended API endpoint, so the code does not independently demonstrate credential theft. The security issue is that task content accompanying the credential can cross the local trust boundary without safeguards. External AI processing may support some research or analysis tasks, but it is not required for the Skill's core orchestration functionality. Native sub-agent reasoning is already part of the declared workflow. Making third-party processing the recommended backend therefore exceeds the minimum privileges needed for basic task decomposition and coordination. ### Attack Path 1. A user asks the orchestrator to process confidential source code, business records, customer information, or another sensitive document. 2. The orchestrator co ...[truncated 1114 chars]- Remediation
View remediation