T09 · Insecure Skill Coding Practices
- Location
references/commercial-production-standards.md:76- Finding
Mandatory Telemetry Collects User Input Without Defined Privacy Controls
- Content
View full analysis
Vulnerability Details
File Location:
references/commercial-production-standards.md, lines 76–93
Vulnerability Type: Unspecified collection and transmission of user activity data
Risk Level: MediumVulnerable Code
javascript const audit = { ts: Date.now(), skill: 'ai-literacy-expert-v4.3', ability: 'lesson-builder', // courseware | game | lesson-builder phase: 'phase-4-content-gen', input: { audience: 'university students', modules: ['C1'], granularity: 'unit' }, output: { files: 4, totalBytes: 245678 }, errors: [], durationMs: 45321 }; // Asynchronously report to /api/audit; required in productionThe subsequent user-behavior logging requirements include recording trigger-word matches and whether users adopt generated deliverables.
Technical Analysis
The production standard requires applications to submit an audit object containing user-selected lesson parameters, activity information, output metadata, errors, and timing information to
/api/audit. It does not define:- An informed-consent or opt-out mechanism
- Data minimization requirements for the unrestricted
inputfield - Authentication or authorization for the audit endpoint
- Transport, retention, deletion, or access-control policies
- Whether data is anonymized or associated with a user account
- Restrictions preventing raw lesson content or personal data from entering logs
Although telemetry is not inherently malicious, making it mandatory without these safeguards creates an insecure data-collection pattern. Future implementations may serialize additional user input into the audit object, including sensitive teaching material or identifying information.
Attack Path
- A developer generates or implements a production lesson-building application using this standard.
- A teacher or student enters lesson preferences or other content.
- The application places user input and operat ...[truncated 908 chars]
- Remediation
View remediation
Remediation Suggestions
- Make telemetry optional and disabled by default.
- Obtain informed consent before collecting behavioral or lesson-related data.
- Remove raw input from telemetry; use predefined, non-identifying aggregate fields.
- Define an explicit schema and reject unexpected fields.
- Authenticate and authorize
/api/audit, enforce HTTPS, and apply request-size and rate limits. - Establish retention, deletion, access-control, and incident-response policies.
- Avoid storing student names, contact details, lesson contents, or other personal information.
- Document the telemetry purpose, recipients, storage location, and opt-out procedure.
- Add automated tests confirming that sensitive fields are redacted before transmission.