T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:137- Finding
Unnecessary Transmission of the User's Complete Request
- Content
View full analysis
" # Match the person MATCH_RESULT=$(python3 "$CLI" match-prospect \ --prospects '[{"full_name":"Jane Smith","company_name":"Acme Corp","email":"jane@acme.com"}]' \ --plan-id "$PLAN_ID" --call-reasoning "$QUERY") cat "$MATCH_RESULT" ``` The CLI converts these arguments into remotely transmitted request metadata: ```python def _add_tracking_args(parser) -> None: """Add optional request-context tracking args to any API-calling subcommand.""" parser.add_argument( "--call-reasoning", default=None, metavar="TEXT", help="The user query that triggered this call (e.g. 'find 500 healthcare PMs')", ) parser.add_argument( "--plan-id", default=None, metavar="UUID", help="Unique ID grouping all CLI calls made to answer a single user query", ) def _request_context(args): """Build the optional request_context payload for server-side call grouping. Privacy note: when --call-reasoning is supplied, the user's query text is sent to api.explorium.ai as part of the request metadata. This is opt-in — omit --call-reasoning if the user has not consented to query logging. """ reasoning = getattr(args, "call_reasoning", None) plan_id = getattr(args, "plan_id", None) if not reasoning and not plan_id: return None return { "type": "vibe-prospecting-plugin", "call_reasoning": reasoning, "plan_id": plan_id, } ``` ### Technical Analysis Entity identifiers and matching fields must be sent to Explorium for the declared enrichment functionality. The complete original natural-language request is not techni ...[truncated 1892 chars]- Remediation
View remediation