T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:18
- Finding
- Sensitive Prompt Disclosure Through URL Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–28 **Vulnerability Type**: Sensitive information exposure through URL-based request design **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## How it's paid (x402 — no key, no signup) HTTPS GET with the prompt URL-encoded in the path. First call returns **HTTP 402**; your OpenClaw wallet auto-pays the USDC fee (Base) and retries, returning the completion. ## Tiers (live endpoints) | Call | Model tier | Price | |---|---|---| | `GET https://api.gocreativeai.com/v1/ai/ask/{prompt}` | Fast & cheap (DeepSeek-tier) | ~$0.02 | | `GET https://api.gocreativeai.com/v1/ai/pro/{prompt}` | Frontier — Claude 4.5 Sonnet (`?model=` to override) | ~$0.08 | | `GET https://api.gocreativeai.com/v1/ai/ultra/{prompt}` | Ultra — Claude Opus 4.6, top-end reasoning | ~$0.25 | URL-encode the prompt. Example: `/v1/ai/ask/Summarize%20this%20contract%20in%203%20bullets`. ``` ### Technical Analysis The skill instructs agents to place the complete prompt in an HTTPS URL path. URL encoding only converts characters into a transport-safe representation; it does not encrypt, redact, or otherwise protect the prompt. Although HTTPS protects the request in transit, URL paths are commonly retained by reverse proxies, API gateways, content delivery networks, web-server access logs, observability platforms, error reports, and client-side request histories. Consequently, prompts containing credentials, proprietary source code, contracts, personal information, or other confidential material may be disclosed to the external provider and to parties with access to intermediary logs. The skill does not warn users against submitting sensitive data, request informed consent for third-party disclosure, or describe retention and deletion controls. ### Attack Path 1. An agent receives a task containing confidential or attacker-selected sensitive information. 2. Following the skill instructions, the agent incorpora ...[truncated 873 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace prompt-bearing GET requests with HTTPS POST requests and place prompts in the request body. - Explicitly prohibit transmitting credentials, private keys, authentication tokens, regulated records, and other sensitive information unless the user has provided informed consent. - Add a mandatory redaction stage that detects and removes secrets and personal information before transmission. - Clearly disclose that prompts are sent to an external provider and document applicable storage, retention, training, and deletion policies. - Configure gateways, proxies, and application servers not to log request bodies or sensitive query and path data. - Provide an allowlist of approved data categories and require confirmation before transmitting content outside the local environment. - Use data minimization so that only information strictly necessary for the requested completion is sent. ]]>