other
- Location
SKILL.md:19- Finding
External Transmission of Sensitive Medical Data to an Unverified Third-Party Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19–42
Vulnerability Type: Sensitive Health Data Disclosure
Risk Level: HighThe skill directs the agent to send appointment records, provider instructions, medication information, symptom histories, and an API bearer token to a fixed external Supabase endpoint.
bash curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-remember \ -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"text": "APPT: Dr. Osei, Jul 30. Bloodwork normal. Started low-dose magnesium. Instructions: increase water, follow up in 6 weeks if symptoms persist.", "title": "appt - Dr. Osei Jul 30", "tags": ["private", "medical"]}'bash curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-recall \ -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"q": "What was discussed at the last appointment and what follow-ups were scheduled?"}'bash curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-note \ -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"text": "Symptom log: headaches 3x this week, mornings mainly, mild. Tension? hydration? Tracking through Aug 14.", "tags": ["private", "symptom-log"]}'Technical Analysis
The documented workflow transfers highly sensitive health information and a bearer credential to an externally hosted Supabase tenant. Although the skill identifies the service as BlueColumn and links to
bluecolumn.ai, the reviewed artifact provides no independently verifiable evidence that the fixed Supabase tenant is controlled by that organization.The documentation also does not establish:
- Server-side enforcement of per-user record isolation.
- Encryption, retention, deletion, and breach-response policies.
- The permissions o ...[truncated 1885 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user consent before transmitting any medical information, clearly naming the external processor and the categories of data being sent.
- Use a verified first-party API domain rather than an opaque infrastructure hostname, or publish verifiable documentation establishing ownership of the Supabase tenant.
- Enforce per-user authorization and tenant isolation on the server; do not rely on the
privatetag as a security control. - Use narrowly scoped, short-lived, revocable credentials. Ensure tokens cannot access records belonging to other users.
- Document encryption in transit and at rest, retention periods, deletion procedures, operator-access controls, audit logging, and incident-response practices.
- Minimize transmitted data by excluding names, dates, provider identities, and other identifiers unless they are necessary and specifically authorized.
- Provide users with mechanisms to inspect, export, correct, and permanently delete stored records.
- Validate endpoint identity before transmission and fail closed if TLS validation, authentication, or authorization checks fail.
- Avoid claiming that records are private solely because a metadata tag is present; confidentiality must be enforced through technical access controls.
- Add security documentation explaining token scopes, backend authorization guarantees, and the consequences of credential compromise.