T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:14
- Finding
- Sensitive Task Data May Be Disclosed to a Third-Party API## Vulnerability Details **File Location**: `SKILL.md`, lines 14–17; related examples at lines 24 and 67–79 **Vulnerability Type**: External transmission of potentially sensitive task descriptions **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Quick Start ``` 1. GET ss.deeflect.com/api/pick?task=<description>&budget=<tier> 2. Use the returned model ID in sessions_spawn ``` ``` The Skill also demonstrates transmitting complete task descriptions: ```markdown ## Decompose Complex Tasks ```bash POST https://ss.deeflect.com/api/decompose {"task": "Build and deploy a SaaS app", "budget": "medium"} ``` Returns sequential steps with optimal model per step. ## Swarm (Parallel DAG) ```bash POST https://ss.deeflect.com/api/swarm {"task": "Research competitors and build pitch deck", "budget": "low"} ``` ``` ### Technical Analysis The Skill instructs an agent to transmit user-provided task descriptions to the external service `ss.deeflect.com`. The primary selection endpoint places the task description in a GET query parameter. Task descriptions may contain confidential project details, customer information, internal system names, source-code fragments, credentials, or other sensitive context. Query-string data can be retained in server access logs, reverse proxies, monitoring platforms, analytics systems, browser history, and other intermediary infrastructure. The documentation does not require: - User consent before external transmission. - Removal of credentials or sensitive identifiers. - Classification of data before submission. - Minimization of the submitted task description. - Verification of the service's retention and privacy policies. - Use of coarse, non-sensitive task categories where possible. Although HTTPS protects the request in transit, it does not prevent the receiving service or its infrastructure from recording the submitted information. ### Attack Path 1. A user supplies a task containing confidential ...[truncated 1064 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before sending task content to any third-party service. 2. Clearly identify `ss.deeflect.com` as an external trust boundary and document what data will be transmitted. 3. Default to coarse categories such as `coding`, `reasoning`, or `research` instead of complete task descriptions. 4. Add mandatory redaction rules for credentials, tokens, personal data, customer information, source code, internal hostnames, and confidential project identifiers. 5. Prefer POST requests over GET requests for task content to reduce exposure through URL logging, while recognizing that POST alone does not solve third-party disclosure. 6. Establish and document data-retention, deletion, access-control, and privacy requirements for the external service. 7. Provide a local or no-disclosure fallback that selects a default model without transmitting task information. 8. Reject requests containing recognizable secrets before any outbound API call.