T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/xqximage.py:43
- Finding
- User prompts are retained in plaintext and reproduced in standard-output logs## Vulnerability Details **File Location**: `scripts/xqximage.py`, lines 43-54 and 154-157 **Vulnerability Type**: Sensitive-data exposure through persistent plaintext storage and logging **Risk Level**: Medium ### Technical Analysis File mode reads the complete user-supplied prompt from a fixed path in the current workspace: ```python def prompt_file_path() -> str: """当前工作目录下的 wdatas/xqx-img-prompt.txt（由 Agent 写入，路径不可配置）""" return os.path.join(os.getcwd(), *PROMPT_FILE_PARTS) def load_prompt_from_wdatas() -> str: path = prompt_file_path() if not os.path.isfile(path): print(f"Error: 未找到 {path}，请在工作目录的 wdatas/xqx-img-prompt.txt 写入提示词") raise SystemExit(1) with open(path, encoding="utf-8") as f: text = f.read() if not text.strip(): print(f"Error: {path} 为空") raise SystemExit(1) return text ``` The file is not removed or cleared after use. The complete prompt is then printed to standard output: ```python print("========== XQX Ark 文生图 ==========") print(f"描述: {prompt}") print(f"尺寸: {size}") print("====================================") ``` `SKILL.md` explicitly instructs the agent to place the original, complete user description in `wdatas/xqx-img-prompt.txt`. Consequently, prompts can remain in the workspace across later operations and are also duplicated into execution logs. Prompts may contain confidential business descriptions, personal data, unreleased campaign material, or other sensitive text. The script also transmits the prompt and `ARK_API_KEY` to the fixed Ark HTTPS endpoint in `generate_image`. That network behavior is necessary for the declared image-generation functionality and does not, by itself, exceed minimum required privileges: the credential is placed in the HTTPS authorization header, the prompt is sent to the documented provider, and neither is sent to an unrelated endpoint. The API key is not printed or writ ...[truncated 1746 chars]
- Remediation
- ## Remediation Suggestions 1. Do not print the full prompt by default. Log only non-sensitive metadata such as prompt length, selected model, and image size. If prompt logging is needed for debugging, require an explicit opt-in flag and clearly warn that it may disclose sensitive information. 2. Prefer accepting prompt content through standard input so no persistent intermediate file is required. 3. If file mode must remain supported, use a uniquely named temporary file created with restrictive permissions, rather than a fixed cross-task path. 4. Delete or securely truncate the prompt file in a `finally` block immediately after reading it. Document that deletion cannot guarantee removal from snapshots, backups, or journaling filesystems. 5. Ensure the directory and file are accessible only to the account running the skill, such as directory mode `0700` and file mode `0600`, while accounting for platform differences. 6. Update `SKILL.md` to instruct callers not to place credentials or unnecessary personal data in prompts and to describe the intended retention policy. 7. Keep the Ark endpoint fixed or enforce an explicit allowlist if endpoint configurability is introduced later. Continue using HTTPS and never log the authorization header or API key.