T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:145
- Finding
- Full Desktop Screenshot Transmitted to a Hard-Coded Endpoint over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 145-174 **Vulnerability Type**: Sensitive-data exposure through insecure network transmission **Risk Level**: High ### Vulnerable Code ```python import subprocess import base64 import requests # 1. Screenshot subprocess.run(['scrot', '/tmp/screen.png']) # 2. Convert to Base64 with open('/tmp/screen.png', 'rb') as f: img_b64 = base64.b64encode(f.read()).decode() # 3. Ask the vision model prompt = """ Analyze the screenshot, locate the check-in button, and return its coordinates. Use JSON format: {"action": "click", "x": 450, "y": 320, "description": "check-in button"} """ response = requests.post( "http://10.6.207.56:8000/v1/chat/completions", headers={"Authorization": "Bearer VLLM_API_KEY"}, json={ "model": "qwen3.5-27b", "messages": [{ "role": "user", "content": [ {"type": "image_url", "image_url": {"url": f"data:image/png;base64,{img_b64}"}}, {"type": "text", "text": prompt} ] }] } ) result = response.json()['choices'][0]['message']['content'] print(result) ``` ### Technical Analysis The documented workflow captures the entire desktop and sends the resulting image to the hard-coded endpoint `http://10.6.207.56:8000`. A full-screen capture can include credentials, authentication tokens, private messages, personal data, confidential documents, and content from applications unrelated to the automation task. Base64 conversion only encodes the image; it does not encrypt or otherwise protect it. Because the destination uses plaintext HTTP, the screenshot and authorization header lack transport confidentiality and integrity. A network-positioned attacker may observe or alter the request or response. The remote service itself also receives the complete screenshot and may log, retain, or process it outside the user's expected trust boundary. The code does not obtain explicit ...[truncated 1838 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the hard-coded HTTP URL with an explicitly configured HTTPS endpoint. 2. Validate the endpoint against a narrowly defined allowlist and reject plaintext HTTP. 3. Require informed user approval before each screenshot is transmitted to a remote service. 4. Capture only the smallest relevant window or screen region instead of the entire desktop. 5. Apply redaction for passwords, tokens, notifications, personal information, and unrelated application content. 6. Prefer local OCR or an on-device vision model when remote processing is unnecessary. 7. Set connection and read timeouts, handle response errors safely, and verify the response schema and coordinate bounds. 8. Protect API credentials using an environment variable or secret manager rather than embedding them in examples or source files. 9. Delete temporary screenshots promptly and create them with restrictive permissions in a secure temporary directory. 10. Display the destination, transmitted data scope, and retention policy before obtaining consent. 11. Require confirmation before executing model-generated actions, especially actions that submit forms, change settings, or access sensitive applications. ]]>