T09 · Insecure Skill Coding Practices
- Location
SKILL.md:183- Finding
Unrestricted Transmission of Potentially Sensitive Prompt Content to a Third-Party API
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 183-195
Vulnerability Type: Sensitive data transmission without minimization, redaction, or explicit consent
Risk Level: MediumVulnerable Code
python import requests, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def call_llm(messages, prefer="balanced"): r = requests.post( "https://api.skillboss.co/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "chat", "inputs": {"messages": messages}, "prefer": prefer}, timeout=60, ) return r.json()["result"]["choices"][0]["message"]["content"]Technical Analysis
The example sends the complete
messagescollection tohttps://api.skillboss.co/v1/pilot. In orchestration, coding, and research workflows, these messages may contain proprietary source code, internal file paths, conversation history, personal information, credentials, or other confidential workspace data.The implementation does not:
- Require explicit approval before external transmission.
- Restrict which message fields may be transmitted.
- Detect or redact secrets and personal data.
- Warn users that their content is processed by a third party.
- Provide a local-only default for the Skill's core prompt-templating functionality.
- Validate the HTTP status before parsing the response.
The API key is retrieved from an environment variable and used as authorization for the declared endpoint. There is no evidence that the key is hardcoded, logged, or sent to an unrelated destination. The principal risk is therefore disclosure of message content rather than credential theft.
This remote model-routing behavior is not necessary for the Skill's core local functionality—prompt construction, agent tracking, and reusable templates—and consequently expands the trust boundary beyond the minimum privilege ...[truncated 1844 chars]
- Remediation
View remediation
Remediation Suggestions
-
Make external processing explicitly opt-in
- Keep prompt construction and agent tracking local by default.
- Require informed user approval before sending any workspace or conversation content to SkillBoss.
- Display the destination hostname and categories of data being transmitted.
-
Minimize transmitted data
- Send only the messages required for the immediate task.
- Exclude unrelated conversation history, system metadata, local paths, and full files unless necessary.
- Apply configurable size and field allowlists.
-
Add sensitive-data controls
- Scan outgoing content for API keys, tokens, private keys, passwords, connection strings, and personal data.
- Redact detected values or block transmission pending user confirmation.
- Never rely solely on users remembering to remove secrets manually.
-
Document the external trust boundary
- Clearly identify SkillBoss as a third-party processor.
- Link to applicable privacy, retention, deletion, and model-training policies.
- Explain whether requests may be forwarded to additional model providers.
-
Provide safer deployment options
- Offer a local-model or user-configured endpoint option.
- Permit organizations to disable external routing centrally.
- Support destination allowlists and enterprise data-loss-prevention controls.
-
Harden request and response handling
- Call
r.raise_for_status()before parsing the response. - Validate the expected response schema.
- Handle timeouts, malformed responses, and connection failures without logging request bodies or credentials.
- Avoid including sensitive prompt content in exceptions or diagnostic logs.
- Call
-