T09 · Insecure Skill Coding Practices
- Location
scripts/download_signals.py:124- Finding
Cloud opt-out bypass discloses a persistent identifier
- Content
View full analysis
Vulnerability Details
File Location:
scripts/session_hook.py:174-190andscripts/download_signals.py:124-139
Vulnerability Type: Privacy and authorization-gate bypass
Risk Level: MediumTechnical Analysis
The documented workflow states that cloud synchronization is disabled by default and requires explicit opt-in. However, the mandatory session-start hook invokes both cloud helpers without first checking
.cloud_optin:python # scripts/session_hook.py:174-190 # 1) Upload previously accumulated signals try: subprocess.run([sys.executable, os.path.join(HERE, "upload_signals.py")], capture_output=True, timeout=120) except Exception: pass # 2) Pull cloud history for this skill try: subprocess.run([sys.executable, os.path.join(HERE, "download_signals.py"), "pull", "--dir", skill_dir], capture_output=True, timeout=120) except Exception: passThe upload helper creates a persistent anonymous identifier before enforcing the cloud-upload setting:
python # scripts/upload_signals.py:122-139 def bootstrap(skill_dir): """Deterministically create state files.""" created = [] optin = os.path.join(skill_dir, ".optin") if not os.path.exists(optin): if write_state_file(optin, "on"): created.append(".optin") anon = os.path.join(skill_dir, ".anon_id") if not os.path.exists(anon): import uuid if write_state_file(anon, str(uuid.uuid4())): created.append(".anon_id") cloud = os.path.join(skill_dir, ".cloud_optin") if not os.path.exists(cloud): if write_state_file(cloud, "off"): created.append(".cloud_optin") return createdAlthough
upload_signals.pylater respects.cloud_optin=off, the download helper does not check that setting. It sends the persistent identifier to the configured aggregation endpoi ...[truncated 2094 chars]- Remediation
View remediation
Remediation Suggestions
-
Enforce cloud authorization directly in
download_signals.cmd_pullbefore reading the identifier, resolving the endpoint, or making any request:python cloud_optin = _read_file(os.path.join(skill_dir, ".cloud_optin")) if cloud_optin != "on": print("[download] Cloud synchronization is disabled; skipping") return 0 -
Add defense in depth to
session_hook.cmd_start: invoke upload and download helpers only when.cloud_optinis exactlyon. -
Keep the default fail-closed. Missing, malformed, or unreadable
.cloud_optinmust be treated as disabled. -
Consider separating the local-recording identifier from the cloud identifier. Create the cloud identifier only after explicit cloud opt-in, preventing local-only operation from provisioning a remotely usable tracking value.
-
Add regression tests covering:
.cloud_optin=off;- a missing
.cloud_optin; .cloud_optin=on;- an environment-supplied aggregation endpoint;
- verification that no network request occurs in either disabled state.
-