T09 · Insecure Skill Coding Practices
- Location
reference/clip-director.md:82- Finding
Automatic Upload of Local Facial Photographs to an External Service
- Content
View full analysis
Vulnerability Details
File Location:
reference/clip-director.md:82-86
Vulnerability Type: Unauthorized external disclosure of biometric-identifying images
Risk Level: MediumComplete Snippet:
markdown - **Con avatar** (segmento sobre el usuario, su logro, su historia): subir foto de `cerebro/fotos` (media_upload → PUT → media_confirm), pasar `medias`, y cerrar el prompt con `, character inspired by the reference image provided, maintain facial features from reference`. Descripción de persona: la descripción física de la usuaria sacada de SUS fotos (nunca un ejemplo fijo).Technical Analysis
The Clip Director instructs the Agent to select a photograph from the local
cerebro/fotosdirectory and upload it through Higgsfield's media-upload workflow whenever a segment concerns the user, their achievements, or their story.The transcript controls whether this classification activates, but the instructions do not require the Agent to:
- obtain explicit consent for uploading a facial image;
- disclose the external destination and processing purpose;
- display and confirm the exact selected file;
- restrict selection to an image explicitly supplied for the current task.
The general plan-confirmation step does not expressly disclose this image transfer. The behavior also conflicts with the faceless scope stated in
SKILL.md:28-30, where the user is told that they never appear on camera and that the video uses generated visuals.This is high-risk privacy behavior rather than proven malicious exfiltration: the documented destination is the video-generation service used by the Skill, and the project contains no evidence of a covert recipient or deliberate theft.
Attack Path
- The user requests a faceless reel and supplies or records a transcript containing a personal achievement or story.
- The Clip Director classifies that portion as a segment “about the user.”
- The Agent accesses
cerebro/fotos, a local photo c ...[truncated 1118 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic discovery and selection of images from
cerebro/fotos. - Default all faceless workflows to non-personal cinematic B-roll with no reference media.
- Require the user to explicitly opt in before any avatar or face-preserving generation.
- Before upload, present the exact local file path, a preview or unambiguous description, the external recipient, the processing purpose, and the applicable retention implications.
- Require a dedicated confirmation immediately before
media_upload; general approval of the visual plan must not authorize sensitive-image transfer. - Restrict uploads to a file explicitly selected or supplied by the user for the current task.
- Record the consent decision in
plan.jsonwithout storing additional sensitive image data. - If consent is declined or cannot be established, omit
mediasand generate an abstract or non-identifying visual. - Align
SKILL.mdwith the implementation by clearly distinguishing “not filmed on camera” from the use of an uploaded facial reference, or prohibit facial references entirely to preserve the advertised faceless behavior.
- Remove automatic discovery and selection of images from