T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create-guiro.sh:55- Finding
Arbitrary User Data Is Published Through an Unauthenticated Public Share Link Without Disclosure Safeguards
- Content
View full analysis
) is an ephemeral Presentation Layer as a Service. You give it a structured JSON bundle describing a layout of visual components, and it returns a short-lived, publicly accessible share link (e.g. `https://guiro.io/s/{slug}`). The rendered page is a polished, read-only visual — a dashboard, report, chart, calendar, or status page. No login or account is needed to view it. Use this skill whenever you produce structured results — metrics, tables, timelines, financial data, event schedules, progress tracking — and want to turn them into a shareable visual artifact the user can open in a browser, send to a colleague, or print to PDF. ``` ```markdown # 2 – Write a sample payload (dashboard | calendar | chart | donut) bash "{baseDir}/scripts/write-sample-payload.sh" ./payload.json dashboard # 3 – Validate and create the guiro bash "{baseDir}/scripts/create-guiro.sh" --payload ./payload.json --idempotency-key run-001 ``` ```markdown The sample payloads are starting points. Replace the placeholder content with real data relevant to the user's request. ``` ```markdown Share the `url` with the user. Guiros are ephemeral — after `expires_at`, the link shows a standardized "This Guiro has Expired" page. ``` From `scripts/create-guiro.sh`: ```bash AUTH_HEADERS=(-H "X-API-Key: ${API_KEY}") validate_response="$(curl -sS -X POST "${API_ORIGIN}/v1/validate" "${AUTH_HEADERS[@]}" -H "Content-Type: application/json" --data-binary "@${PAYLOAD_FILE}")" ``` ```bash create_cmd=(curl -sS -X POST "${API_ORIGIN}/v1/create" "${AUTH_HEADERS[@]}" -H "Content-Type: application/json" --data-binary "@${PAYLOAD_FILE}") if [ -n "${IDEM ...[truncated 2417 chars]- Remediation
View remediation