T09 · Insecure Skill Coding Practices
- Location
SKILL.md:102- Finding
Local Images Are Uploaded to Permanently Public, Unsigned URLs Without Explicit Consent
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 102–113; related upload commands appear at lines 131–134
Vulnerability Type: Unsafe external file disclosure and indefinite public retention
Risk Level: MediumVulnerable Code Snippet
The following is an English rendering of the relevant instructions in
SKILL.md:markdown ## Local File Upload When the user provides a local file path instead of a public direct URL, upload the file to obtain a direct URL before calling the generation API. - URL: POST https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload - Request method: multipart/form-data - The file field name is fixed as file - Authentication: pass secretKey in the request header Use data.fullPath from a successful response as the public direct URL, which is permanently valid and does not contain a signature.Related executable examples:
bash curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_KEY" --max-time 120 -F "file=@C:/path/to/product.png" curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_KEY" --max-time 120 -F "file=@./product.png"Technical Analysis
The skill directs the agent to upload user-selected local images to a third-party service whenever a local path is supplied. The resulting
data.fullPathvalue is explicitly described as a permanently valid, unsigned public URL.An unsigned public URL acts as a bearerless resource: possession of the URL is sufficient to access the image, and no authentication or expiration is required. The instructions do not require the agent to:
- Explain that the image will become publicly retrievable.
- Obtain explicit informed consent before uploading.
- Check whether the image contains confidential, personal, regulated, or proprietary information.
- Apply access controls or a limited retention pe ...[truncated 1931 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit informed consent before every local-file upload. State the destination service, purpose, expected retention period, and access model.
- Do not describe or use permanent unsigned URLs as the default. Store uploads privately and return short-lived signed URLs with the minimum lifetime required for generation.
- Delete uploaded objects automatically after the generation request completes or after a short, documented retention period.
- Add a deletion endpoint or documented revocation workflow and provide the object identifier to the user.
- Warn users not to upload credentials, identity documents, confidential business files, regulated data, or images containing sensitive metadata.
- Require confirmation of the exact file path before reading or uploading it. Do not infer additional files or expand directories.
- Validate file type and size locally, strip unnecessary metadata where appropriate, and reject unsupported or unexpectedly sensitive files.
- Avoid printing or persistently logging returned public URLs. Redact them from diagnostics, transcripts, and error reports where possible.
- Document the third party's retention, geographic storage, privacy, deletion, and access-control policies.
- If private storage and reliable deletion cannot be provided, restrict the feature to user-supplied public URLs and disable automatic local-file uploads.