T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:187- Finding
Local Images Are Uploaded as Permanent, Unauthenticated Public Objects
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 187–221
Vulnerability Type: Permanent public exposure of user-provided local files
Risk Level: MediumVulnerable Code Snippet
markdown ## 本地文件上传 用户提供的是本地文件路径而不是公网直链时，先把文件上传换取直链，再调用本接口。已安装 `file-upload` 技能时以该技能为准；未安装时按下面的说明直接调用上传接口。 - **URL**: `POST https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload` - **请求方式**: `multipart/form-data`，文件字段名固定为 `file`，单次只能上传一个文件，多个文件并发调用多次 - **认证方式**: 请求头传 `secretKey`，与本技能使用同一个密钥 - **超时时间**: 图片建议 60-120 秒 - **不要手动设置 `Content-Type` 请求头**，让 HTTP 客户端自动生成带 boundary 的值，手写会导致服务端解析失败 - 图片仅支持 `bmp`、`gif`、`jpg`、`jpeg`、`png`，`webp` 需先转成 `png` 或 `jpg`；文件名必须带正确后缀，服务端靠它判断格式 - 原文件名不会出现在 URL 里，中文名、空格、特殊字符都能直接上传，不需要提前改名 - 上传不消耗算力，但服务端不做去重：同一个文件在一次任务里只上传一次，记下 `fullPath` 复用 成功响应取 `data.fullPath` 作为公网直链，永久有效、不带签名： ```json { "code": 200, "msg": null, "data": { "relativePath": "cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png", "fullPath": "https://agent-1404002717.cos.ap-guangzhou.myqcloud.com/cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png", "serviceProvider": null } }bash curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png" curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@./product.png"text ### Technical Analysis The skill instructs the agent to upload a user-selected local image to a third-party service whenever the image is not already available through a public URL. The returned object URL is explicitly described as permanently valid and unsigned. Consequently, possession of the URL is sufficient to retrieve the uploaded image without authentication. The workflow does not require explicit, informed confirmation immediately before the upload. It also documents no expiration policy, deletion mechanism, revocation process, or authenticated a ...[truncated 1984 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit informed consent immediately before every local-file upload. State the destination service, the purpose of the transfer, and the expected retention and accessibility properties.
- Replace permanent public objects with private storage and short-lived signed URLs scoped to the minimum duration needed for image generation.
- Add a documented deletion endpoint or automatic expiration policy, and invoke deletion after the generation task completes.
- If the provider cannot support private or expiring objects, prominently warn users that the file will become accessible to anyone with the URL and may remain available indefinitely.
- Display and require confirmation of the exact local path before reading or uploading it to prevent accidental file selection.
- Advise users not to upload confidential, regulated, or personally sensitive images. Where feasible, detect and block clearly sensitive paths or content.
- Minimize propagation of returned URLs: do not print them unnecessarily, persist them in configuration, or include them in verbose logs.
- Strip unnecessary image metadata, such as EXIF location and device information, before upload when doing so does not interfere with the requested task.
- Document a revocation and incident-response procedure for cases where an uploaded URL is disclosed.