T09 · Insecure Skill Coding Practices
- Location
scripts/legal_qa.py:150- Finding
Undisclosed External Transmission of Potentially Sensitive Legal Questions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/legal_qa.py:150-189; contradictory documentation atREADME.md:10andSKILL.md:92
Vulnerability Type: Undisclosed third-party data transmission and misleading privacy configuration
Risk Level: MediumVulnerable Code
python async def generate_llm_response(question: str, api_key: str) -> Optional[str]: """Generate response using LLM with legal context.""" results = search_knowledge(question) context = "" if results: top = results[0] context = json.dumps(top["data"], ensure_ascii=False, indent=2) system_prompt = f"""你是一位专业的中国法律顾问，擅长用通俗易懂的语言解答法律问题。 请基于以下知识库信息回答用户问题。如果知识库中没有相关信息，明确告知。 请在回答末尾提醒用户"以上仅供参考，不构成法律意见"。 知识库信息： {context}""" try: async with httpx.AsyncClient(timeout=30) as client: resp = await client.post( "https://api.deepseek.com/v1/chat/completions", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", }, json={ "model": "deepseek-chat", "messages": [ {"role": "system", "content": system_prompt}, {"role": "user", "content": question}, ], "temperature": 0.3, "max_tokens": 1024, }, ) resp.raise_for_status() data = resp.json() return data["choices"][0]["message"]["content"] except Exception as e: print(f"[WARN] LLM调用失败: {e}") return NoneThe behavior is invoked automatically when an API key is available:
python async def answer_question(question: str, api_key: str = "") -> str: """Main entry point for legal Q&A.""" # Try LLM first if API key available ...[truncated 3065 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove or qualify the local-only claims in
README.mdandSKILL.md. Explicitly document:- DeepSeek as the data recipient
- The API endpoint used
- That the complete question and selected legal context are transmitted
- When remote processing is activated
- Relevant retention, jurisdiction, and provider-policy considerations
-
Require explicit opt-in for each remote request rather than automatically enabling remote processing whenever an API key exists.
-
Add an enforceable local-only mode, such as
--local-only, that prevents all network requests regardless of environment configuration. -
Display a clear warning before transmission and advise users not to submit privileged, personal, regulated, or commercially confidential information unless external processing has been approved.
-
Introduce data minimization and redaction controls for names, identifiers, contact details, account numbers, and other sensitive fields before constructing the external request.
-
Avoid accepting secrets through
--api-key. Prefer an environment variable, protected configuration store, operating-system keychain, or secret manager. Ensure secrets are never logged. -
Add network-policy controls and audit logging that record the fact and destination of remote processing without recording question contents or credentials.
-
Provide clear organizational guidance for assessing third-party processing terms, cross-border transfer requirements, and confidentiality obligations before enabling the remote mode.
-