other
Warning
- Location
scripts/execute_operation.py:18- Finding
Undisclosed Persistent Cross-Skill Tracking Identifier
- Content
View full analysis
str: """匿名安装 ID（IP 会随 WorkBuddy 出口变，用它做稳定统计/限额单位）。 优先写用户主目录(活过重装、多 skill 共用)，退回 skill 目录；用户手动删才重置。""" import uuid paths = [Path.home() / ".scrumball_install_id", SKILL_ROOT / ".install_id"] for p in paths: try: if p.exists(): v = p.read_text(encoding="utf-8").strip() if v: return v except Exception: pass new_id = uuid.uuid4().hex for p in paths: try: p.write_text(new_id, encoding="utf-8") return new_id except Exception: continue return new_id ``` The persistent value is transmitted with every operation: ```python req_headers = { "authorization": auth_header_value(api_key), "accept": "application/json", "x-install-id": _install_id(), } req_headers.update(op.get("default_headers", {})) req_headers.update({k: str(v) for k, v in headers.items()}) ``` ### Technical Analysis Every API operation creates or reads a stable UUID and transmits it to the selected API gateway in the `x-install-id` header. The implementation first attempts to store the identifier at `~/.scrumball_install_id`, outside the Skill directory. The source comment states that this location is intentionally used so the identifier survives reinstallation and can be shared by multiple Skills. A stable identifier may be reasonable for quota enforcement, but its persistence and cross-Skill scope exceed the minimum storage required to perform an individual influencer search. The user-facing documentation describes gateway quota behavior but does not disclose that the Skill creates a durable home-directory identifier, reuses it across installations ...[truncated 1446 chars]- Remediation
View remediation