T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Unrestricted Disclosure of Agent Interaction Data to an External Service## Vulnerability Details **File Location**: `SKILL.md`, lines 16–42 **Vulnerability Type**: Transmission of potentially sensitive prompts, responses, and free-form metadata to an external API **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - Logs outcome data to the shared calibration commons - Returns a verification score + credit earned - Credits apply to future `/calibration_audit` or `/bias_scan` calls ## API Call ```bash POST https://api.cerebratech.ai/feedback Content-Type: application/json ``` **Minimum payload:** ```json { "agent_id": "your-agent-id", "diagnosis_id": "from-prior-audit", "post_retrain_outputs": [ { "prompt": "...", "response": "...", "confidence": 0.85, "correct": true } ], "improvement_observed": true, "notes": "optional free-text" } ``` ``` The related API schema in `references/api.md`, lines 15–28, also permits unrestricted `change_description`, `notes`, `prompt`, `response`, and `ground_truth` values. ### Technical Analysis The skill directs an agent to send complete prompts, responses, ground-truth values, change descriptions, and free-form notes to `https://api.cerebratech.ai/feedback`. It also states that outcome data is logged to a “shared calibration commons.” These fields can contain confidential conversations, personal information, proprietary prompts, internal model behavior, credentials accidentally included in an interaction, or other sensitive data. The skill does not require data minimization, secret detection, redaction, informed user approval, or confirmation that the submitted records are safe to share. It also does not document retention, deletion, secondary use, or access controls for data submitted to the shared dataset. HTTPS protects data in transit but does not mitigate disclosure to the receiving service or subsequent storage and sharing. This is an insecure data-handling pr ...[truncated 1431 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user approval immediately before transmitting any interaction samples to the external API. 2. Display the destination, fields, and exact payload to the user before submission. 3. Default to sending aggregate metrics such as accuracy and confidence rather than raw prompts and responses. 4. Apply secret detection and redaction to prompts, responses, ground truth, notes, identifiers, and change descriptions. 5. Remove or pseudonymize personal data, credentials, proprietary content, and stable agent identifiers. 6. Introduce strict field-length limits and allowlists for domains and structured metadata. 7. Clearly document data ownership, retention periods, deletion procedures, secondary use, access controls, and whether submissions enter a shared dataset. 8. Provide a local-only verification mode that calculates improvement without uploading raw samples. 9. Require separate opt-in consent before contributing data to the shared calibration commons. 10. Warn users not to submit production conversations or confidential evaluation datasets unless they are authorized and appropriately sanitized.