T09 · Insecure Skill Coding Practices
- Location
scripts/send_inr.sh:6- Finding
Hardcoded Personal and Medical Data in Email Transmission Workflow
- Content
View full analysis
Vulnerability Details
File Location:
scripts/send_inr.sh:6-23
Vulnerability Type: Hardcoded sensitive data and fixed transmission endpoints
Risk Level: MediumThe script hardcodes the patient's full name, date of birth, sender account, and recipient email addresses. It combines this information with an INR measurement and transmits the resulting medical record through a locally configured Gmail client.
bash RECIPIENT="creatif.lrb@aphp.fr" if [ "$IS_TEST" == "--test" ]; then RECIPIENT="harpoutian@gmail.com" fi CURRENT_DATE=$(LC_TIME=fr_FR.UTF-8 date +"%A %d %B" | sed -e 's/lundi/Lundi/' -e 's/mardi/Mardi/' -e 's/mercredi/Mercredi/' -e 's/jeudi/Jeudi/' -e 's/vendredi/Vendredi/' -e 's/samedi/Samedi/' -e 's/dimanche/Dimanche/') MESSAGE="Bonjour, Aujourd'hui ${CURRENT_DATE} mon INR est de ${INR_VALUE} (automesure). Merci et bonne journée, Gilles Harpoutian né le 16/07/1974" SUBJECT="INR de Gilles Harpoutian - ${CURRENT_DATE}" # Utilisation de l'outil gog pour envoyer l'e-mail # gog gmail send --to <recipient> --subject <subject> --body <message> --account <account_email> /root/go/bin/gog gmail send --to "${RECIPIENT}" --subject "${SUBJECT}" --body "${MESSAGE}" --account harpoutian@gmail.comTechnical Analysis
The source code contains directly identifying information and fixed email-routing configuration. An INR value is health information; combining it with a full name and date of birth produces an identity-linked medical record. Storing those identifiers in a distributable skill exposes them to anyone who can read the project, its archives, or its version history.
Every invocation transmits the supplied measurement under the hardcoded patient's identity. The script does not require recipient confirmation, obtain patient identity from a secure configuration source, or verify that the active
gogaccount and intended recipient are appropriate for the current ...[truncated 1740 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the patient's full name, date of birth, sender account, and recipient addresses from source-controlled files.
- Load account and recipient configuration from a protected configuration or secret-management mechanism with restrictive file permissions.
- Accept patient details only when necessary and minimize identifying content in the email body.
- Display the destination and redacted message summary and require explicit confirmation before transmission.
- Validate the INR value against an expected numeric format and medically reasonable application-defined bounds before sending.
- Require an explicit recipient selection rather than silently defaulting to a production medical address.
- Verify that the authenticated
gogaccount matches the configured sender before transmission and handle send failures safely. - Remove sensitive data from repository history and previously distributed archives where feasible, and assess whether exposure requires privacy-incident handling.
- Document consent, retention, transport-security, and access-control requirements for processing identity-linked medical information.