T09 · Insecure Skill Coding Practices
Warning
- Location
- references/artifact-recipes.md:16
- Finding
- Unredacted HAR Collection May Expose Authentication Secrets and Private Data<![CDATA[ ## Vulnerability Details **File Location**: `references/artifact-recipes.md:16-18` (invoked by `SKILL.md:65-67`) **Vulnerability Type**: Sensitive information exposure through excessive artifact collection **Risk Level**: Medium ### Vulnerable Code `references/artifact-recipes.md:16-18`: ```markdown ## What a page actually requested (HAR) Any browser: `F12` → Network tab → reproduce the problem → right-click any row → "Save all as HAR with content" → send the file. ``` The recipe is explicitly incorporated into agent behavior by `SKILL.md:65-67`: ```markdown | Modality gap / feedback gap (needs their eyes) | User | Request the artifact + the fastest recipe to produce it (pre-written: `{baseDir}/references/artifact-recipes.md` — copy the recipe, don't improvise one) | ``` ### Technical Analysis The Skill directs the agent to copy a recipe asking users to export and send an entire HAR file “with content.” Such files can contain substantially more information than is necessary to diagnose a particular request, including: - `Authorization` headers and bearer tokens - Session cookies and anti-CSRF tokens - API keys embedded in headers or URLs - Sensitive query parameters - Request and response bodies - Personal, financial, or proprietary application data - Internal hostnames, endpoints, and infrastructure metadata The recipe provides no warning, redaction procedure, scope restriction, or instruction to inspect the file before uploading it. Because `SKILL.md` tells the agent to copy the recipe rather than improvise safer guidance, this unsafe collection behavior may be reproduced consistently. This exceeds minimum necessary access when a screenshot, selected request metadata, sanitized request export, or a narrowly filtered HAR would answer the diagnostic question. There is no evidence that the data is deliberately sent to an attacker-controlled endpoint; the risk is unintended disclosure to the chat provider, agent environment, logging systems, ...[truncated 1551 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove “Save all as HAR with content” as the default diagnostic route. 2. Prefer lower-sensitivity evidence first: - A screenshot of the relevant Network panel entry - The request URL with secret query parameters removed - HTTP method, status code, timing, and non-sensitive headers - A single relevant request rather than the complete browser session 3. If a HAR is essential, instruct the user to: - Record only the minimum reproduction window. - Log out of unrelated services and close unrelated tabs first. - Remove `Authorization`, `Cookie`, `Set-Cookie`, API-key, and proxy-authentication headers. - Remove tokens, passwords, email addresses, account identifiers, and secret query parameters. - Remove or replace sensitive request and response bodies. - Review the sanitized file in a text editor before upload. 4. Warn users that HAR files may contain active session credentials and private content. 5. Recommend revoking or rotating any credential accidentally included in an uploaded HAR. 6. Update the Skill instruction so agents adapt the recipe to the minimum artifact required instead of copying unsafe collection guidance verbatim. 7. Add a verification checkpoint requiring the agent to confirm that requested artifacts are proportionate and include explicit sanitization guidance. A safer replacement would be: ```markdown Ask for a screenshot or selected metadata from the relevant Network request first. If a HAR is strictly necessary, record only the minimum reproduction, remove authorization headers, cookies, tokens, secret query parameters, and sensitive bodies, then inspect the sanitized file before sending it. Never upload an unreviewed HAR from an authenticated session. ``` ]]>