T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:29
- Finding
- Unnecessary Disclosure of Local Artifact and Repository Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–45 **Vulnerability Type**: External transmission of potentially sensitive project metadata **Risk Level**: Medium ### Vulnerable Code ```bash ARTIFACT_HASH=$(sha256sum "$ARTIFACT_PATH" | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/receipts \ -H "Content-Type: application/json" \ -d "{ \"action\": \"agent.task.complete\", \"subject\": \"$ARTIFACT_PATH\", \"artifact_hashes\": [ {\"label\": \"$ARTIFACT_PATH\", \"sha256\": \"$ARTIFACT_HASH\"} ], \"context\": { \"repo\": \"${GITHUB_REPOSITORY:-local}\", \"commit\": \"${GIT_COMMIT:-unknown}\" } }" ``` ### Technical Analysis The documented default workflow sends the local `ARTIFACT_PATH`, `GITHUB_REPOSITORY`, and `GIT_COMMIT` values to the external service at `https://api.mpps.io/v1/receipts`. Submitting an artifact hash is necessary for the Skill's declared remote-attestation functionality. However, the local path, repository identifier, and commit identifier are not required to notarize that hash. These fields therefore exceed the minimum information necessary for the operation. A local artifact path may contain usernames, customer names, confidential project names, workspace layouts, or internal directory structures. A private repository identifier and commit hash may expose internal development activity or enable correlation with other information. The risk is increased by the documentation's statement that receipts are retained for ten years. The later privacy guidance warns users not to include secrets or private source text, but the primary example still transmits potentially identifying metadata by default. No raw artifact content or credentials are shown as being transmitted. ### Attack Path 1. A user follows the structured-receipt example in `SKILL.md`. 2. The shell expands `ARTIFACT_PATH`, `GITHUB_REPOSITORY`, and `GIT_COMMIT` using values from the loca ...[truncated 1181 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to an opaque, non-identifying subject and label, such as `artifact`, rather than using the local filesystem path. 2. Omit `context.repo` and `context.commit` from the default request because they are not required for hash attestation. 3. Make the transmission of repository, commit, path, or other identifying metadata an explicit opt-in operation. 4. Display a clear privacy and retention warning immediately before the network request example rather than only in a later section. 5. Recommend reviewing the complete request payload before submission. 6. Construct the JSON using a proper serializer, such as `jq` or Python's `json` module, instead of direct shell interpolation. This prevents malformed JSON when metadata contains quotes, backslashes, or control characters. 7. Provide a privacy-preserving default example, for example: ```bash ARTIFACT_HASH=$(sha256sum "$ARTIFACT_PATH" | awk '{print "sha256:" $1}') jq -n --arg hash "$ARTIFACT_HASH" '{ action: "agent.task.complete", subject: "artifact", artifact_hashes: [ {label: "artifact", sha256: $hash} ] }' | curl -s -X POST https://api.mpps.io/v1/receipts \ -H "Content-Type: application/json" \ --data-binary @- ``` 8. Document that users should avoid hashing short secrets directly and should use an appropriate salt or a larger non-secret payload where necessary. ]]>