T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:29
- Finding
- Sensitive User Text Disclosed to an Undocumented Third-Party TTS Service and Embedded in URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-17, 29-43, 75-80, and 84-95 **Vulnerability Type**: Third-party data disclosure and sensitive information exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## API Base URL \`\`\` https://tts.102465.xyz \`\`\` All endpoints are under the `/api` prefix. ``` ```markdown ### POST (recommended for longer text or programmatic use) \`\`\`bash curl -X POST https://tts.102465.xyz/api/tts \ -H "Content-Type: application/json" \ -d '{"text":"你好世界","voice":"晓晓","emotion":"温柔","provider":"azure"}' \ --output output.mp3 \`\`\` ### GET (convenient for short text or browser-playable links) \`\`\` https://tts.102465.xyz/api/tts?text=你好世界&voice=晓晓&provider=azure \`\`\` The response is an audio file (MP3). Save it with `--output` in curl, or open the GET URL directly in a browser to play. ``` ```markdown 3. **Generate the audio** — Call `/api/tts` with the chosen parameters. For programmatic use, POST with JSON body; for a quick shareable link, construct a GET URL. 4. **Deliver the result** — If using curl/POST, save the MP3 to `/mnt/user-data/outputs/` and present it to the user. If constructing a GET link, provide the URL so the user can play it in-browser. ``` ### Technical Analysis The skill instructs the agent to transmit arbitrary user-provided text to `tts.102465.xyz`, an external intermediary whose ownership, data-retention practices, privacy policy, and relationship with the stated Azure, Volcengine, and Edge providers are not documented. Although HTTPS protects data in transit, it does not prevent the remote service operator from receiving, retaining, analyzing, or forwarding the submitted text. The workflow does not require informed user consent, assess whether the text contains confidential information, or warn against submitting credentials, personal data, private communications, proprietary scripts, or other sensitive mater ...[truncated 2135 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove GET-based synthesis** - Do not place user text in URL query parameters. - Require POST requests with a JSON body for all synthesis operations. - Do not generate or present shareable URLs containing source text. 2. **Obtain informed consent** - Clearly notify users before transmitting text to an external service. - Identify the service operator and explain that submitted text leaves the local environment. - Require explicit confirmation when content may be confidential or personal. 3. **Document privacy properties** - Provide the service's privacy policy, retention period, deletion process, subprocessors, and applicable data-processing terms. - Explain whether requests or generated audio are logged, stored, or used for model training. 4. **Prevent sensitive submissions** - Warn users not to submit passwords, API keys, authentication tokens, financial information, regulated personal data, or proprietary content. - Add a sensitivity check before sending text externally. - Refuse or request redaction when obvious credentials or secrets are detected. 5. **Prefer trusted deployment models** - Use authenticated official provider APIs directly instead of an undocumented intermediary. - Alternatively, use a locally hosted TTS engine for confidential content. - Allow administrators to configure an approved endpoint rather than hardcoding a single external host. 6. **Minimize and protect retained data** - Submit only the text required for synthesis. - Configure service, proxy, and application logs not to retain request bodies or sensitive parameters. - Establish automatic deletion for submitted text and generated audio. - Document local MP3 storage, access controls, and cleanup procedures. ]]>