T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:30- Finding
Identifiable Alumni and Compensation Data Stored in Plaintext
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 30–42 and 108–112
Vulnerability Type: Plaintext storage of sensitive personal data
Risk Level: MediumVulnerable Code
python @dataclass class AlumniRecord: """校友记录数据类""" name: str graduation_year: int degree: str # PhD, Master, Bachelor current_status: str # industry, academia, startup, other organization: str position: str location: str = "" field: str = "" salary_range: str = "" notes: str = ""python def _save_data(self): """保存数据到文件""" self.data_path.parent.mkdir(parents=True, exist_ok=True) with open(self.data_path, 'w', encoding='utf-8') as f: json.dump([r.to_dict() for r in self.alumni], f, ensure_ascii=False, indent=2)Technical Analysis
The application collects personally identifiable and potentially sensitive information, including names, employers, positions, locations, notes, and salary ranges. The
_save_datamethod serializes every field directly into an unencrypted JSON file.The implementation does not apply encryption, field-level redaction, access-permission hardening, consent tracking, retention controls, or anonymization before persistence. It also does not prevent the default database or exported copies from being committed to source control, copied into backups, or read by other local processes with filesystem access.
This behavior conflicts with the privacy protections described in
SKILL.md, including its statements that reports should use aggregated data and that individual salary information must not be shared. The documentedprivacy_guard.pycomponent is not present in the audited project.Attack Path
- A user adds or imports alumni records containing names, employment information, locations, salary ranges, or private notes.
add_alumniinvokes_save_data, which serializes all record fi ...[truncated 1054 chars]
- Remediation
View remediation
Remediation Suggestions
- Minimize collection of salary data and free-form notes; do not collect fields that are unnecessary for the stated analysis.
- Encrypt sensitive records at rest using a reviewed encryption library and keep encryption keys outside the data file and source repository.
- Create database and export files with restrictive owner-only permissions, such as mode
0600on supported systems. - Add explicit consent, retention, deletion, and opt-out metadata to each record.
- Produce anonymized or aggregated reports by default. Require an explicit, clearly warned option to export identifiable records.
- Exclude names, salary ranges, and notes from routine analytical output unless specifically required and authorized.
- Warn users when an output path is located inside a source repository or broadly shared directory.
- Document secure backup, deletion, and access-control requirements.
- Implement and test the privacy controls claimed by the documentation rather than relying on procedural checklist language alone.