T09 · Insecure Skill Coding Practices
Warning
- Location
- reference/clip-director.md:82
- Finding
- Automatic Upload of Local Facial Photographs to an External Service## Vulnerability Details **File Location**: `reference/clip-director.md:82-86` **Vulnerability Type**: Unauthorized external disclosure of biometric-identifying images **Risk Level**: Medium **Complete Snippet**: ```markdown - **Con avatar** (segmento sobre el usuario, su logro, su historia): subir foto de `cerebro/fotos` (media_upload → PUT → media_confirm), pasar `medias`, y cerrar el prompt con `, character inspired by the reference image provided, maintain facial features from reference`. Descripción de persona: la descripción física de la usuaria sacada de SUS fotos (nunca un ejemplo fijo). ``` ### Technical Analysis The Clip Director instructs the Agent to select a photograph from the local `cerebro/fotos` directory and upload it through Higgsfield's media-upload workflow whenever a segment concerns the user, their achievements, or their story. The transcript controls whether this classification activates, but the instructions do not require the Agent to: - obtain explicit consent for uploading a facial image; - disclose the external destination and processing purpose; - display and confirm the exact selected file; - restrict selection to an image explicitly supplied for the current task. The general plan-confirmation step does not expressly disclose this image transfer. The behavior also conflicts with the faceless scope stated in `SKILL.md:28-30`, where the user is told that they never appear on camera and that the video uses generated visuals. This is high-risk privacy behavior rather than proven malicious exfiltration: the documented destination is the video-generation service used by the Skill, and the project contains no evidence of a covert recipient or deliberate theft. ### Attack Path 1. The user requests a faceless reel and supplies or records a transcript containing a personal achievement or story. 2. The Clip Director classifies that portion as a segment “about the user.” 3. The Agent accesses `cerebro/fotos`, a local photo c ...[truncated 1118 chars]
- Remediation
- ## Remediation Suggestions - Remove automatic discovery and selection of images from `cerebro/fotos`. - Default all faceless workflows to non-personal cinematic B-roll with no reference media. - Require the user to explicitly opt in before any avatar or face-preserving generation. - Before upload, present the exact local file path, a preview or unambiguous description, the external recipient, the processing purpose, and the applicable retention implications. - Require a dedicated confirmation immediately before `media_upload`; general approval of the visual plan must not authorize sensitive-image transfer. - Restrict uploads to a file explicitly selected or supplied by the user for the current task. - Record the consent decision in `plan.json` without storing additional sensitive image data. - If consent is declined or cannot be established, omit `medias` and generate an abstract or non-identifying visual. - Align `SKILL.md` with the implementation by clearly distinguishing “not filmed on camera” from the use of an uploaded facial reference, or prohibit facial references entirely to preserve the advertised faceless behavior.