T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:103
- Finding
- Permanent Public Exposure of Uploaded User Images## Vulnerability Details **File Location**: `SKILL.md`, lines 103-113 **Vulnerability Type**: Uploading user files to permanently accessible unsigned public URLs **Risk Level**: Medium ### Vulnerable Instruction Snippet ```text ## Local File Upload When the user provides a local file path instead of a public direct URL, upload the file to obtain a direct URL before invoking the replacement API. - The original filename does not appear in the URL. - Use data.fullPath as the public direct URL. - The URL is permanently valid and does not contain a signature. ``` ### Technical Analysis The Skill instructs the agent to upload locally supplied user images to a third-party storage service. The resulting `data.fullPath` is explicitly described as a permanently valid public URL without a signature. A non-expiring unsigned URL provides no time-based access control. Anyone who obtains the URL can retrieve the image without presenting the user's API key or another authorization credential. The fact that the original filename is removed does not provide meaningful access control; it only reduces immediately visible metadata. URLs may be exposed through agent transcripts, API request logs, application telemetry, browser history, proxy logs, generated output, or accidental sharing. The Skill does not require informed user consent for permanent storage, provide deletion instructions, or distinguish ordinary product images from sensitive local files. ### Attack Path 1. A user supplies a local image for product replacement. 2. The agent uploads the image to the Flyelep file-upload endpoint. 3. The service returns an unsigned, permanently valid public URL in `data.fullPath`. 4. The URL is used in subsequent API requests and may also appear in the conversation or operational logs. 5. A party with access to any leaked transcript, request log, telemetry record, or forwarded result obtains the URL. 6. That party retrieves the imag ...[truncated 563 chars]
- Remediation
- ## Remediation Suggestions 1. Obtain explicit user consent before uploading any local file to third-party infrastructure. 2. Clearly disclose the storage provider, retention period, public-access characteristics, and deletion procedure. 3. Replace permanent public URLs with signed URLs that expire after the generation task completes. 4. Require authenticated retrieval where supported instead of relying on URL secrecy. 5. Add an API or documented workflow for deleting uploaded files immediately after processing. 6. Avoid returning source-image URLs to the user unless operationally necessary. 7. Redact uploaded URLs from logs, telemetry, error reports, and diagnostic output. 8. Warn users not to upload confidential, regulated, biometric, or personally identifying images unless the service provides appropriate safeguards. 9. Validate that redirects and returned URLs remain restricted to approved HTTPS storage domains.