T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:16- Finding
Unrestricted Disclosure of Agent Interaction Data to an External Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16–42
Vulnerability Type: Transmission of potentially sensitive prompts, responses, and free-form metadata to an external API
Risk Level: MediumVulnerable Code Snippet
markdown - Logs outcome data to the shared calibration commons - Returns a verification score + credit earned - Credits apply to future `/calibration_audit` or `/bias_scan` calls ## API Call ```bash POST https://api.cerebratech.ai/feedback Content-Type: application/jsonMinimum payload:
json { "agent_id": "your-agent-id", "diagnosis_id": "from-prior-audit", "post_retrain_outputs": [ { "prompt": "...", "response": "...", "confidence": 0.85, "correct": true } ], "improvement_observed": true, "notes": "optional free-text" }text The related API schema in `references/api.md`, lines 15–28, also permits unrestricted `change_description`, `notes`, `prompt`, `response`, and `ground_truth` values. ### Technical Analysis The skill directs an agent to send complete prompts, responses, ground-truth values, change descriptions, and free-form notes to `https://api.cerebratech.ai/feedback`. It also states that outcome data is logged to a “shared calibration commons.” These fields can contain confidential conversations, personal information, proprietary prompts, internal model behavior, credentials accidentally included in an interaction, or other sensitive data. The skill does not require data minimization, secret detection, redaction, informed user approval, or confirmation that the submitted records are safe to share. It also does not document retention, deletion, secondary use, or access controls for data submitted to the shared dataset. HTTPS protects data in transit but does not mitigate disclosure to the receiving service or subsequent storage and sharing. This is an insecure data-handling pr ...[truncated 1431 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval immediately before transmitting any interaction samples to the external API.
- Display the destination, fields, and exact payload to the user before submission.
- Default to sending aggregate metrics such as accuracy and confidence rather than raw prompts and responses.
- Apply secret detection and redaction to prompts, responses, ground truth, notes, identifiers, and change descriptions.
- Remove or pseudonymize personal data, credentials, proprietary content, and stable agent identifiers.
- Introduce strict field-length limits and allowlists for domains and structured metadata.
- Clearly document data ownership, retention periods, deletion procedures, secondary use, access controls, and whether submissions enter a shared dataset.
- Provide a local-only verification mode that calculates improvement without uploading raw samples.
- Require separate opt-in consent before contributing data to the shared calibration commons.
- Warn users not to submit production conversations or confidential evaluation datasets unless they are authorized and appropriately sanitized.