T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:504- Finding
Uncontrolled Transmission of Sensitive Construction Lineage Data to an External AI Service
- Content
View full analysis
dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` The quick-start workflow exports the complete lineage dataset, embeds it in an AI prompt, and transmits it: ```python # AI analysis via SkillBoss API Hub lineage_data = tracker.export_lineage() analysis_prompt = f"Analyze this construction data lineage and identify potential data quality risks:\n{lineage_data}" result = pilot({ "type": "chat", "inputs": { "messages": [{"role": "user", "content": analysis_prompt}] }, "prefer": "balanced" }) analysis = result["result"]["choices"][0]["message"]["content"] print(analysis) ``` The exported content includes project, system, ownership, location, entity, and transformation information: ```python def export_lineage(self) -> Dict: """Export complete lineage data.""" return { 'project_id': self.project_id, 'exported_at': datetime.now().isoformat(), 'sources': {k: { 'id': v.id, 'name': v.name, 'system': v.system, 'location': v.location, 'owner': v.owner } for k, v in self.sources.items()}, 'entities': {k: { 'id': v.id, 'name': v.name, 'source_id': v.source_id, 'entity_type': v.entity_type, 'parent_entities': v.parent_entities } for ...[truncated 4498 chars]- Remediation
View remediation