T09 · Insecure Skill Coding Practices
- Location
skill.md:179- Finding
Unredacted Prompt Content Transmitted to a Third-Party LLM API
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 179–186
Vulnerability Type: Uncontrolled transmission of potentially sensitive information to a third party
Risk Level: Mediumpython SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def call_llm(messages, prefer="balanced"): r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "chat", "inputs": {"messages": messages}, "prefer": prefer}, timeout=60, )Technical Analysis
The documented implementation sends the complete
messagesarray tohttps://api.heybossai.com/v1/pilot. No data-classification check, secret redaction, payload minimization, or explicit user-consent mechanism is applied before transmission.LLM message collections can contain confidential source code, credentials, personal information, internal documents, system instructions, or other private context. Although HTTPS protects the request in transit, it does not prevent the receiving service from accessing, retaining, logging, or processing the submitted content.
Supplying the API key in the
Authorizationheader is a conventional authentication mechanism and is not, by itself, evidence of credential theft. The security concern is the unrestricted forwarding of message content across a third-party trust boundary. The remote API integration is also not essential to the Skill's primary educational guidance about prompt and agent orchestration, making the unconditional environment-key requirement and broad data transfer exceed the minimum privileges necessary for that core functionality.The project contains documentation rather than an automatically executed script. Exploitation therefore requires a user or agent to adopt and execute the documented example.
Attack Path
- A user or orchestrating agent places sens ...[truncated 1197 chars]
- Remediation
View remediation
Remediation Suggestions
- Make third-party API routing explicitly optional and remove
SKILLBOSS_API_KEYfrom globally required configuration when the integration is disabled. - Obtain informed user confirmation before transmitting prompt content, clearly identifying the destination host and the categories of data being sent.
- Apply data minimization by sending only the messages and fields required for the selected operation.
- Add secret detection and redaction for API keys, passwords, tokens, private keys, connection strings, personal information, and other sensitive patterns.
- Reject or require additional confirmation for payloads classified as confidential or containing sensitive source code and internal documents.
- Document the provider's retention, logging, training-use, deletion, residency, and subprocessors policies so users can make an informed decision.
- Enforce destination allowlisting, TLS certificate validation, request-size limits, and restrictive timeout and retry behavior.
- Avoid logging authorization headers or complete request payloads, and ensure errors cannot disclose the API key.
- Provide a local or user-selected provider alternative for workflows that cannot transfer data to third parties.
- Add prominent documentation warning users not to include credentials or confidential data unless they have explicitly approved external processing.
- Make third-party API routing explicitly optional and remove