T09 · Insecure Skill Coding Practices
- Location
references/vector_recall_impl.py:55- Finding
Confidential Research Content Is Transmitted to an External Embedding Service Without an Explicit Consent Gate
- Content
View full analysis
Vulnerability Details
File Location:
references/vector_recall_impl.py, lines 55–65
Vulnerability Type: Sensitive-data disclosure to a third-party service
Risk Level: MediumVulnerable Code
python def _embed_one(self, text): text = (text or "").strip() if not text: return None if text in self._cache: return self._cache[text] body = json.dumps({"model": self.model, "input": [text]}).encode("utf-8") req = urllib.request.Request( self.url, data=body, headers={"Authorization": "Bearer " + self.key, "Content-Type": "application/json"}, method="POST", )Technical Analysis
The
_embed_one()method serializes its entiretextargument and sends it to the configured SiliconFlow embedding endpoint. In the documented workflow, this text can contain an extracted claim from a private meeting or a candidate document's title and abstract.Research claims may contain unpublished intellectual property, confidential project details, participant information, or other sensitive meeting content. Although the skill documentation mentions the external embedding tier, the audited implementation contains no explicit consent check, redaction stage, data-classification control, or local-only default before transmission. The documented meeting-access authorization only governs access to Tencent Meeting data and does not independently establish consent to disclose that data to another processor.
Attack Path
- A user authorizes access to a private Tencent Meeting transcript or provides a confidential research idea directly.
- The skill extracts the discussion into a structured research claim.
- The claim is passed to
VectorRefiner.refine(). refine()calls_embed_one()for the claim and each candidate title and abstract._embed_one()sends the complete text to the external embedding service.- Confidential content ...[truncated 683 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed opt-in before enabling remote embeddings for meeting-derived or user-confidential content.
- Clearly disclose which fields are transmitted, the service provider, processing purpose, retention policy, and applicable data jurisdiction.
- Default to the local Tier C implementation or a local embedding model when consent is absent.
- Add a preprocessing stage that removes participant names, email addresses, identifiers, and unrelated confidential context.
- Provide a strict local-only mode that prevents all outbound transmission.
- Add an implementation-level policy parameter, such as
allow_remote_processing=False, rather than relying only on documentation. - Log only transmission metadata needed for diagnostics; do not log claims, transcripts, abstracts, authorization headers, or raw API responses.