T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/zcm_lib/cli.py:198- Finding
Undeclared Collection and Transmission of Host Identity Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/zcm_lib/cli.py:198-232
Vulnerability Type: Undeclared host fingerprint collection and external transmission
Risk Level: MediumThe implementation contradicts the permission declaration at
SKILL.md:10-16, which states that device information is not collected. The trial workflow collects the local hostname, operating-system type, architecture, username, home-directory path, and a persistent hash derived from the network-interface identifier, then sends these values to the configured API.Relevant permission declaration (
SKILL.md:10-16):yaml metadata: permissions: network: - biaoshu.zhiliaobiaoxun.com（招采猫 API，唯一外联目标） filesystem: read: 仅用户明确提供的招标/投标文件与本 skill 自身脚本 write: biaoshu-bailian-files/（产物）；~/.zcm/config.json（凭证，权限 600，logout 可删） environment: - ZCM_APP_KEY（可选：App Key，替代凭证文件） - ZCM_BASE / ZCM_CONFIG / ZCM_HOME / ZCM_OUTPUT_DIR（可选：地址与路径覆盖） billing: 标书生成消耗 App Key 所属账户积分（提交前预检余额） not-collected: 设备信息 / 手机号 / 验证码 / 除上述 ZCM_* 外的任何环境变量Host-data collection and transmission (
scripts/zcm_lib/cli.py:198-232):python def _collect_device(): """采集 6 项设备特征；任一失败置空串，绝不中断。""" import getpass import platform as _platform import socket import uuid as _uuid def _try(fn): try: v = fn() return str(v).strip() if v else "" except Exception: return "" def _mac(): node = _uuid.getnode() if (node >> 40) & 0x01: # 组播位=1：随机 MAC，视为采集失败 return "" return hashlib.sha256(str(node).encode("utf-8")).hexdigest() return { "hostname": _try(socket.gethostname), "platform": _try(_platform.system), "arch": _try(_platform.machine), "username": _try(getpass.getuser), "home_path": _try(lambda: os.path.expanduser("~")), ...[truncated 2603 chars]- Remediation
View remediation
Remediation Suggestions
- Correct the structured permission metadata so it accurately lists every collected host attribute, its purpose, destination, and retention behavior.
- Require explicit opt-in before collecting or transmitting a device fingerprint. Display the exact fields before consent.
- Remove
hostname,username, andhome_pathunless each is demonstrably necessary for trial-abuse prevention. - Replace host-derived identifiers with a random installation identifier generated locally and stored with restrictive permissions.
- If a stable identifier is essential, use a narrowly scoped, service-specific value and document whether it can be correlated across accounts or installations.
- Minimize server-side retention and prohibit secondary use of fingerprinting data.
- Add tests that compare declared permissions with the fields included in the trial-registration request, preventing future disclosure regressions.