T09 · Insecure Skill Coding Practices
Warning
- Location
src/screen.py:177- Finding
Full-Desktop Screenshots Are Persisted Without Data Minimization
- Content
View full analysis
np.ndarray: """Full-screen screenshot""" img = pyautogui.screenshot() return cv2.cvtColor(np.array(img), cv2.COLOR_RGB2BGR) ``` ```python def scan(self) -> dict: """ Scan the game screen and return game state. """ image = self.capture.capture_full() return { 'my_cards': self.recognizer.recognize_cards(image, 'my_cards'), 'left_cards_count': self._count_cards(image, 'left_cards'), 'right_cards_count': self._count_cards(image, 'right_cards'), 'played_cards': self.recognizer.recognize_played_cards(image), 'landlord': self.recognizer.recognize_landlord(image), 'screenshot': image } ``` ```python def save_screenshot(self, path: str = "logs/screenshot.png"): """Save screenshot""" image = self.capture.capture_full() cv2.imwrite(path, image) ``` ```python # Save screenshot self.scanner.save_screenshot("logs/last_scan.png") print("\nScreenshot saved to logs/last_scan.png") ``` ### Technical Analysis The card recognizer only processes predefined game regions, but `capture_full()` captures the entire desktop. During an interactive scan, one full-screen image is captured for recognition and another full-screen image is captured and written to `logs/last_scan.png`. The persisted PNG is not encrypted, access-controlled by the application, automatically deleted, or governed by a retention policy. Consequently, unrelated information visible on other areas of the desktop can be collected and retained even though it is unnecessary for card recognition. Such content may include messages, email, notifications, account details, documents, or cr ...[truncated 1281 chars]- Remediation
View remediation