other
Warning
- Location
- skill.md:38
- Finding
- Unrestricted Transmission of Evaluation Messages to a Third-Party API<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 38–51 **Vulnerability Type**: Sensitive Data Exposure **Risk Level**: Medium ### Vulnerable Code ```python SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def call_llm(messages: list) -> str: r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={ "type": "chat", "inputs": {"messages": messages}, "prefer": "balanced" }, timeout=60, ) return r.json()["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The `call_llm` function sends the complete caller-provided `messages` object to the fixed third-party endpoint `https://api.heybossai.com/v1/pilot`. It does not classify, minimize, filter, or redact the content before transmission. Agent-evaluation messages may contain system prompts, production conversations, customer information, proprietary benchmark material, credentials, access tokens, or other confidential data. Although remote LLM access is relevant to the Skill's declared evaluation functionality and the destination is disclosed, requiring all calls to use this external endpoint exceeds minimum privilege when local or user-selected processing could perform the same function. The Skill also provides no explicit consent control, retention-policy notice, or safeguard preventing production data from being submitted. The API key is obtained from an environment variable and transmitted as a bearer token over HTTPS to its intended endpoint. There is no evidence that the key itself is stolen or sent to an unrelated destination. The finding concerns unrestricted disclosure of the `messages` payload. The function additionally fails to call `raise_for_status()` or validate the response schema before accessing nested fields. This can cause availability or reliability failures, ...[truncated 1912 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit authorization for remote processing** - Clearly notify users that evaluation messages will leave the local environment. - Require an explicit opt-in before sending production traces or other sensitive datasets. 2. **Minimize and sanitize request data** - Add a preprocessing layer that removes credentials, API keys, authorization headers, personal data, and unnecessary metadata. - Use allowlisted fields rather than forwarding arbitrary message objects. - Reject payloads that match known secret formats unless an authorized override is provided. 3. **Support least-privilege backends** - Allow users to select a local model or an approved configurable endpoint. - Do not mandate a single external processor when the evaluation can be completed locally. - Restrict configurable endpoints to HTTPS and, where appropriate, an administrative allowlist. 4. **Document data handling** - State what data is transmitted, the receiving organization, applicable retention periods, logging behavior, and deletion procedures. - Warn users not to submit production or regulated data unless the endpoint is approved for that data class. 5. **Improve request and response handling** - Call `r.raise_for_status()` before processing the response. - Validate the response content type and schema. - Handle timeouts, malformed responses, and API errors without exposing submitted content or credentials in logs. 6. **Protect authentication material** - Continue loading the API key from a protected secret source rather than hardcoding it. - Ensure exceptions and diagnostic logs never include the bearer token. - Use a narrowly scoped, revocable credential if the service supports scoped API keys. ]]>