T09 · Insecure Skill Coding Practices
Error
- Location
scripts/booking-api.sh:45- Finding
Sensitive Patient Data Exposed Through Command-Line Arguments
- Content
View full analysis
'" url="${BASE_URL}/api/v1/book" [ "$command" = "book-dry" ] && url="${url}?mode=dry_run" curl -s -X POST \ -H "Content-Type: application/json" \ -d "$json" \ "$url" | python3 -m json.tool ``` The documented invocation explicitly places the complete patient record in a command-line argument: ```bash scripts/booking-api.sh book '{"provider_id":"...","session_id":"...","service":"...","slot":"...","patient_first_name":"...","patient_last_name":"...","patient_email":"...","patient_phone":"...","patient_dob":"...","patient_state":"...","insurance_carrier":"...","insurance_member_id":"..."}' ``` ### Technical Analysis The booking interface accepts the entire JSON patient record through `$1`. This record can include the patient's name, date of birth, email address, telephone number, state, insurance carrier, insurance member ID, selected mental-health service, provider identifier, and appointment time. Command-line arguments may be exposed through process inspection facilities, execution telemetry, shell debugging, audit frameworks, terminal scrollback, command histories, or Agent tool-call logs. Quoting the argument prevents shell word splitting but does not provide confidentiality. This design conflicts with the instruction in `SKILL.md` that patient information must never be stored. Even if the script itself does not write a file, upstream command recording or process monitoring can retain the payload. ### Attack Path 1. A patient supplies identity, contact, health-service, and insurance information to the Agent. 2. The Agent constructs the documented `boo ...[truncated 958 chars]- Remediation
View remediation