T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:65
- Finding
- Unconditional Transmission of User Messages, Conversation History, and Metadata<![CDATA[ ## Vulnerability Details **File Location**: `index.js:65-98`, `index.js:104-120`, and `index.js:242-250` **Vulnerability Type**: Unintended sensitive-data disclosure caused by incorrect fallback logic **Risk Level**: High ### Vulnerable Code ```js shouldFallback(response, confidence) { // Scenario 1: confidence is too low if (confidence && confidence < this.config.fallbackThreshold) { return true; } // Scenario 2: response is empty or too short if (!response || response.length < 10) { return true; } // Scenario 3: response contains an inability-to-answer keyword const unableKeywords = [ '无法回答', '不能回答', '不知道', 'not sure', "i don't know", "can't answer", "unable to" ]; const lowerResponse = response.toLowerCase(); if (unableKeywords.some(keyword => lowerResponse.includes(keyword))) { return true; } // Scenario 4: response is overly generic const genericPatterns = [ /^这是一个好问题/, /^that's a good question/, /^i understand/ ]; if (genericPatterns.some(pattern => pattern.test(response))) { return true; } return true; } ``` The data sent after the unconditional fallback decision includes the current message and recent conversation history: ```js async getCloudResponse(userMessage, context) { const sessionId = context.sessionId || 'default'; // Retrieve conversation history let history = this.conversationHistory.get(sessionId) || []; // Build the remote model message list const messages = [ { role: 'system', content: this.buildSystemPrompt(context) }, ...history.slice(-10), { role: 'user', content: userMessage } ]; ``` Optional user metadata is also incorporated into the remote system prompt: ```js buildSystemPrompt(context) { const basePrompt = `你是一个智能助手，正在帮助用户解决问题。 请提供准确、详细、有帮助的回答。 如果问题涉及实时信息或你不确定的内容，请诚实说明。`; if (context.metadata && context.metadata.userInfo) { return `${basePrompt}\n\n用户信息: ${JSON.stringify(co ...[truncated 2324 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the unconditional final return with a negative result: ```js return false; ``` 2. Require an explicit fallback condition before constructing or transmitting a cloud request. 3. Exclude `metadata.userInfo` by default. If it is operationally necessary, use an explicit allowlist of required fields and obtain informed user consent. 4. Provide a clear disclosure identifying what data is sent, to which service, and under which conditions. 5. Permit only HTTPS endpoints except for explicitly approved loopback development addresses. 6. Validate `apiUrl` against an administrator-controlled allowlist to reduce arbitrary data-exfiltration destinations. 7. Use a cryptographically strong, per-session identifier and reject missing session identifiers in multi-user deployments rather than using the shared `"default"` history bucket. 8. Add automated tests confirming that adequate local responses produce `false` and do not result in outbound requests. 9. Add retention limits and explicit cleanup policies for conversation history. ]]>