T09 · Insecure Skill Coding Practices
Warning
- Location
client.py:217- Finding
Unsanitized user queries are disclosed to a third-party analysis service
- Content
View full analysis
dict: """ Build the exact payload sent to api.neurodoc.app. WHAT IS SENT: prices, volumes, query text WHAT IS NOT SENT: API keys, secrets, credentials, wallet addresses Run `python client.py` to print this payload and verify yourself. """ # Build context from LOCALLY-fetched data (only numbers, no keys) context_lines = [f"Market query: {query}", "", "LIVE MARKET DATA:"] for coin in market_data: if isinstance(coin, dict): context_lines.append( f" {coin.get('symbol','?').upper()}: " f"${coin.get('current_price',0):,.2f} " f"24h:{coin.get('price_change_percentage_24h',0):+.1f}% " f"MCap:${coin.get('market_cap',0)/1e9:.1f}B" ) context_lines.append("\nEXCHANGE DATA:") for ex in exchange_data: if ex: context_lines.append( f" {ex.get('exchange','?')}: " f"bid={ex.get('bid',0)} ask={ex.get('ask',0)} " f"vol={ex.get('volume',0)}" ) flow_code = f'''flow CryptoAnalysis {{ using target "neuroaether" version ">=0.3"; input text query; node Apex: crypto mode="{mode}", language="en"; output text result from Apex; }}''' payload = { "code": flow_code, "query": "\n".join(context_lines), } return payload ``` The resulting payload is transmitted without further validation: ```python # Step 3: Build payload — VERIFY: no keys in this dict payload = build_api_requ ...[truncated 2948 chars]- Remediation
View remediation
str: if not isinstance(query, str): raise TypeError("Query must be a string") query = query.strip() if not query: raise ValueError("Query must not be empty") if len(query) > MAX_QUERY_LENGTH: raise ValueError(f"Query exceeds {MAX_QUERY_LENGTH} characters") return query ``` 2. Add detection and redaction for common credential patterns, authorization headers, private keys, seed phrases, email addresses, and wallet addresses. Because automated redaction is imperfect, do not claim that personal data can never be sent. 3. Display an explicit notice or obtain consent before forwarding free-form text to NeuroDoc, particularly when the Skill is embedded in another application. 4. Prefer structured inputs such as asset symbols and predefined analysis options over unrestricted natural-language context whenever possible. 5. Add tests proving that: - Oversized queries are rejected. - Known secret formats are blocked or redacted. - Only approved payload fields are transmitted. - Environment credentials cannot appear in serialized requests. 6. Update `SKILL.md` to accurately explain that the full user query is transmitted and may contain sensitive information unless the user removes it. Do not state that all queries are sanitized until corresponding controls exist. ]]>