T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/zcm_lib/cli.py:202- Finding
Device Fingerprint Collection Contradicts Declared Data-Collection Scope
- Content
View full analysis
Vulnerability Details
File Location:
scripts/zcm_lib/cli.py:202-233; conflicting declarations inSKILL.md:13-15,26
Vulnerability Type: Undisclosed collection and transmission of local device identifiers
Risk Level: MediumComplete Code Snippet
python def _collect_device(): """采集 6 项设备特征；任一失败置空串，绝不中断。""" import getpass import platform as _platform import socket import uuid as _uuid def _try(fn): try: v = fn() return str(v).strip() if v else "" except Exception: return "" def _mac(): node = _uuid.getnode() if (node >> 40) & 0x01: # 组播位=1：随机 MAC，视为采集失败 return "" return hashlib.sha256(str(node).encode("utf-8")).hexdigest() return { "hostname": _try(socket.gethostname), "platform": _try(_platform.system), "arch": _try(_platform.machine), "username": _try(getpass.getuser), "home_path": _try(lambda: os.path.expanduser("~")), "mac_hash": _try(_mac), } def _trial_flow(): """免费试用：设备指纹自动注册 → 拿 Api Key 写入 config.json。幂等：同设备返回原 Key。""" body = {"device": _collect_device()} if CHANNEL: body["channel"] = CHANNEL resp = _anon_json("POST", "/trial-accounts", json_body=body)The Skill metadata makes the following conflicting declaration:
yaml environment: - ZCM_APP_KEY（可选：App Key，替代凭证文件） - ZCM_BASE / ZCM_CONFIG / ZCM_HOME / ZCM_OUTPUT_DIR（可选：地址与路径覆盖） billing: 标书生成消耗 App Key 所属账户积分（提交前预检余额） not-collected: 设备信息 / 手机号 / 验证码 / 除上述 ZCM_* 外的任何环境变量Elsewhere,
SKILL.md:26states that device characteristics are automatically collected:markdown **安装完成后，助手会自动为你开通试用账号**（零输入，赠 50,000 字，自动采集设备特征，Api Key 自动保存、下次免输）Technical Analysis
The trial-registration path invokes
_collect_device()and gathers six categories of local information:- Hostname
- Operating-system name
- CPU architecture
- Local username
- User home-directory path
- SH ...[truncated 2605 chars]
- Remediation
View remediation
Remediation Suggestions
-
Minimize collected data
- Remove
username,home_path, andhostnameunless each field is strictly necessary. - Avoid deriving a persistent identifier from the hardware MAC address.
- If abuse prevention requires a device identifier, generate a random application-specific identifier and store it locally.
- Remove
-
Enforce explicit consent in code
- Require a dedicated flag such as
--consent-device-registration. - Reject trial registration unless that flag is present or an interactive prompt receives affirmative consent.
- Display the exact fields, destination, purpose, and retention implications before collection.
- Require a dedicated flag such as
-
Correct the Skill metadata
- Remove the false
not-collected: device informationdeclaration. - Enumerate every device field that can be read and transmitted.
- Keep the metadata, user-facing instructions, and executable behavior consistent.
- Remove the false
-
Constrain the destination
- Validate that trial-registration data is sent only over HTTPS to the documented service origin.
- Do not allow an inherited or stored base URL override to redirect device-registration data without separate informed approval.
-
Provide a privacy-preserving alternative
- Permit users to supply an existing API key without device collection.
- Clearly separate ordinary authenticated operation from optional trial registration.
- Document retention, deletion, and account-unlinking procedures for collected identifiers.
-