T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:327
- Finding
- Local Development Mode Exposes Sensitive Email Data in Agent Output## Vulnerability Details **File Location**: `SKILL.md`, lines 327–333 **Vulnerability Type**: Sensitive data exposure through logging **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Local Dev Mode If `TRUNCUS_API_KEY` is not set in the environment, do not attempt to call the API. Instead: 1. Print the full request payload that would be sent (to, from, subject, body preview). 2. Log: `[truncus-email] Simulated send — set TRUNCUS_API_KEY to send for real.` 3. Return a simulated success with `message_id: "local-simulated"`. ``` ### Technical Analysis When `TRUNCUS_API_KEY` is unavailable, the Skill instructs the Agent to print the email request payload. This includes recipient and sender addresses, the subject, and a body preview. Transactional emails may contain personal information, operational incident details, financial reports, password-reset content, or account information. Agent output can be retained in conversation histories, terminal output, CI/CD logs, debugging systems, or centralized observability platforms. Consequently, an absent or misconfigured API key changes the workflow from transmitting the message to the intended email service into disclosing its contents through local output channels. The issue is particularly relevant because the documented use cases include reports, receipts, password resets, monitoring alerts, and messages containing account details. The exposure does not require compromise of the Truncus API or possession of its API key. ### Attack Path 1. A user or automated workflow asks the Agent to construct an email containing sensitive information. 2. `TRUNCUS_API_KEY` is absent, expired from the environment, or unavailable because of deployment misconfiguration. 3. The Skill automatically enters local development mode. 4. Following the Skill instructions, the Agent prints the recipient, sender, subject, and body preview. 5. The output is retained in an Agent transcript, terminal log, CI log, or monit ...[truncated 711 chars]
- Remediation
- ## Remediation Suggestions 1. Do not print email bodies or full payloads by default in local development mode. 2. Return only a simulation status and non-sensitive request metadata, such as whether required fields were present. 3. Redact recipient and sender addresses, for example `a***@example.com`. 4. Omit or heavily truncate subjects and body previews because they may contain credentials, tokens, personal data, or operational details. 5. Require an explicit debug option, such as `TRUNCUS_DEBUG_PAYLOAD=true`, before displaying any payload preview. 6. Display a confidentiality warning and request user confirmation before enabling verbose payload output. 7. Apply automated redaction for API keys, authorization headers, passwords, reset links, access tokens, session identifiers, and common personal-data fields. 8. Ensure production and CI environments disable verbose simulation output and configure log retention and access controls appropriately. 9. Clearly label the operation as simulated without returning a response shape that downstream workflows could mistake for an actual delivery. A safer default would be: ```markdown If `TRUNCUS_API_KEY` is not set: 1. Do not print the body, attachments, metadata, or complete email addresses. 2. Log only: `[truncus-email] Simulated send; no email was delivered.` 3. Return `status: "simulated"` and `message_id: "local-simulated"`. 4. Reveal a redacted payload preview only after explicit user confirmation. ```