T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:3
- Finding
- Overbroad Activation Can Transmit Unintended User Queries to External Search Providers## Vulnerability Details **File Location**: `SKILL.md`, lines 3 and 32-37 **Vulnerability Type**: Overbroad automatic activation and unintended third-party data disclosure **Risk Level**: Medium ### Relevant Code The following is a faithful English rendering of the relevant activation and workflow instructions: ```yaml description: > Trigger terms include: search, find, look up, domestic search, Chinese search, which company, which one, ranking, comparison, latest, how is it, is it good, how much, what, how, why, learn about, investigate, review, recommend, and evaluation. ``` ```text Phase 1: Query preprocessing 1. Read engine names and URL templates from config.json. 2. Validate that the query is not empty. 3. Classify the request as general, academic, video, news, or bilingual. 4. Select one to three preferred engines and one fallback. 5. For privacy, political, medical, or financial keywords, explain the planned search scope and ask whether to continue. 6. URL-encode the keywords and substitute them into the {keyword} URL. ``` The resulting query can be transmitted through templates such as: ```text https://cn.bing.com/search?q={keyword}&ensearch=0 https://www.so.com/s?q={keyword} https://www.toutiao.com/search/?keyword={keyword} https://search.bilibili.com/all?keyword={keyword} ``` ### Technical Analysis The Skill legitimately requires outbound network access because its declared purpose is search aggregation. However, its activation description includes generic terms equivalent to “what,” “how,” “why,” “latest,” and “recommend.” These terms occur in many ordinary questions that do not clearly request an external search. Once activated, the workflow converts the request into a query and sends it to one or more third-party providers. The confirmation checkpoint applies only when the Skill recognizes privacy, political, medical, or financial keywords. Other confidential or ...[truncated 2455 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict activation to explicit search intent, such as “search the web,” “look this up online,” or a direct request to use a named search provider. 2. Remove generic activation terms equivalent to “what,” “how,” “why,” “latest,” and “recommend.” 3. Before an outbound request, display the exact query and intended provider whenever the query was inferred from conversational context or may contain non-public information. 4. Expand sensitive-data checks beyond the current four categories. Detect personal identifiers, credentials, private URLs, internal project names, source-code fragments, legal matters, employment information, and proprietary data. 5. Minimize transmitted content by constructing a concise query rather than forwarding full user messages or surrounding conversation. 6. Use only the minimum number of providers needed for the request. Do not send the same potentially sensitive query to multiple engines unless the user requests aggregation. 7. Allow users to select or exclude providers before transmission. 8. Preserve the documented in-memory-only cookie behavior, clear cookies after each search, and avoid reusing search sessions across users or conversations. 9. Add tests confirming that ordinary informational questions do not activate the Skill without explicit external-search intent.