T09 · Insecure Skill Coding Practices
- Location
core/__init__.py:29- Finding
Documented PII Filtering Does Not Sanitize Values Sent to the Remote API
- Content
View full analysis
Vulnerability Details
File Location:
core/__init__.py:29-40; affected data flows includecore/diagnose.py:44-48andcore/search.py:40-43. The unsupported privacy guarantee appears inSKILL.md:24,SKILL.zh.md:24, andCHANGELOG.md:27.Vulnerability Type: Inadequate sanitization of sensitive user data and misleading privacy control
Risk Level: Medium
Vulnerable Code
core/__init__.py:29-40:python # 字段白名单 — 只发送必要数据, 不在代码层面泄露用户信息 _ALLOWED_FIELDS = { "symptoms", "language", "gender", "category", "keywords", "constitution", "dietary_preference", "dish_name", "meal_type", "dishes", } def _sanitize_payload(data: dict) -> dict: """白名单过滤: 仅允许 API 需要的字段通过, 拦截意外传入的个人信息.""" if not isinstance(data, dict): return data return {k: v for k, v in data.items() if k in _ALLOWED_FIELDS}core/diagnose.py:44-48:python return _api_request("POST", "/api/diagnose", { "symptoms": symptoms, "language": language, "gender": gender, })core/search.py:40-43:python return _api_request("POST", "/api/search", { "category": category, "keywords": keywords, }).get("results", [])The conflicting statement in
SKILL.md:24says:markdown | Data sent | **Only symptom descriptions, constitution types, disease terms, and ingredient names.** A field whitelist at the code level automatically filters out accidentally included personal information (names, ID numbers, addresses, phone numbers, etc.) — these are stripped client-side and never reach the server |Technical Analysis
_sanitize_payload()only checks the names of top-level dictionary fields. It does not inspect, validate, or redact the values contained in permitted fields such assymptomsandkeywords.Consequently, a value such as:
python diagnose(["J ...[truncated 2309 chars]- Remediation
View remediation
Remediation Suggestions
-
Correct the documentation immediately. Remove the assertion that personal identifiers are automatically stripped and state that values inside allowed fields are transmitted verbatim unless a genuine value-level control is implemented.
-
Implement value-level sanitization if the guarantee is retained. Recursively inspect strings inside lists, dictionaries, and other supported structures. Detect and redact at least explicitly claimed identifier classes, including telephone numbers, identification numbers, email addresses, and postal addresses.
-
Do not overstate automated name detection. Reliable identification of personal names in free-form multilingual medical text is difficult. If complete removal cannot be guaranteed, disclose the limitation and require users to review data before transmission.
-
Add strict input validation. Require expected types, reject nested objects where they are unnecessary, impose string and list length limits, and reject malformed input rather than forwarding it.
-
Add explicit consent at the integration boundary. Before the first remote diagnosis or health-related search, clearly identify the destination, categories of data being transmitted, and the fact that free-form values may contain sensitive information.
-
Create regression tests. Tests should demonstrate how representative identifiers embedded in
symptoms,keywords, disease names, and constitution strings are either redacted or rejected before JSON serialization. -
Keep privacy claims aligned across all files. Update
SKILL.md,SKILL.zh.md,CHANGELOG.md, function documentation, and release metadata so that they accurately describe the implemented control.
-