T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:96
- Finding
- Sensitive User Profiles Are Transmitted to Unspecified External AI Services## Vulnerability Details **File Location**: `SKILL.md`, lines 96–138 **Vulnerability Type**: Uncontrolled disclosure of sensitive data to external services **Risk Level**: High **Relevant instruction excerpts translated into English:** ```text Line 96: Second, convert the new tag data into vectors and update the corresponding ChromaDB collections. For each dimension (skills, interests, goals, challenges, and basic_info), convert the dimension's tag text into a vector through an embedding API, and then upsert it into the corresponding collection. Line 128: LLM deep matching: Submit the tag summaries of A and B to an LLM and separately evaluate situational consistency and capability complementarity. For the specific prompt template and scoring logic, refer to references/matching-algorithm.md. Line 138: Fields whose disclosure setting is "private" must not appear in any information presented to the other party and are used only internally by the matching algorithm. ``` ### Technical Analysis The skill directs the agent to transmit every listed profile dimension to an embedding API and to submit both users' profile summaries to an LLM. These dimensions include potentially sensitive basic information, personal goals, challenges, interests, and skills. The disclosure policy only prevents a `private` field from being shown to another matched user. It does not prevent that field from being transmitted to the embedding provider or LLM provider for algorithmic processing. The instructions do not define: - Approved or allowlisted service providers - Informed user consent for third-party processing - Exclusion of private fields from remote requests - Data minimization or field-level redaction - Provider retention and model-training restrictions - Transport-security requirements - Identifier pseudonymization - Deletion or revocation procedures - Audit logging for external disclosures Consequently, da ...[truncated 1479 chars]
- Remediation
- ## Remediation Suggestions 1. Exclude all `private` fields from external API requests by default. Process them only with an approved local model unless the user gives explicit, purpose-specific consent. 2. Introduce a field-level outbound-data policy that separately controls storage, matching use, embedding, LLM submission, and disclosure to other users. 3. Send only the minimum attributes necessary for each scoring operation. Replace raw profile text with coarse, non-identifying features whenever possible. 4. Remove user IDs and other stable identifiers before sending data to external providers. Use short-lived pseudonymous request identifiers. 5. Restrict integrations to allowlisted providers with enforced TLS, no-training commitments, zero-retention or contractually limited retention, regional processing controls, and documented deletion procedures. 6. Require informed consent before remote AI processing and provide users with opt-out, data-export, correction, and deletion mechanisms. 7. Add outbound request auditing that records the provider and field categories sent without duplicating sensitive content in logs. 8. Validate that referenced matching prompts cannot include private attributes through indirect concatenation or derived summaries.