T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hooks/web-fetch-pre.sh:21- Finding
Outbound DLP hooks fail open and permit sensitive-data exfiltration
- Content
View full analysis
&1) || true if echo "$DOMAIN_RESULT" | grep -q "BLOCKED"; then echo "🚫 DataGuard: Blocked request to high-risk domain" >&2 echo "Domain: $DOMAIN" >&2 echo "Reason: Domain is in blocklist (pastebin, webhook, etc.)" >&2 "$AUDIT_LOG" --log-block "web_fetch" "$DOMAIN" "BLOCKED_DOMAIN" "10" "$URL" >&2 exit 10 fi BODY=$(echo "$INPUT" | sed -n 's/.*"\(body\|data\|payload\)"\s*:\s*"\([^"]*\)".*/\2/p' | head -1) if [ -n "$BODY" ]; then RISK_OUTPUT=$(echo "$BODY" | "$DLP_SCAN" 2>&1) || RISK_SCORE=$? RISK_SCORE=${RISK_SCORE:-0} if [ "$RISK_SCORE" -ge 6 ]; then echo "🚫 DataGuard: Blocked sensitive data transfer" >&2 echo "URL: $URL" >&2 echo "" >&2 echo "$RISK_OUTPUT" >&2 "$AUDIT_LOG" --log-block "web_fetch" "$DOMAIN" "SENSITIVE_DATA" "$RISK_SCORE" "[REDACTED]" >&2 exit "$RISK_SCORE" fi fi ``` ```bash # scripts/hooks/exec-pre.sh:83-99 if echo "$COMMAND" | grep -qiE '(-d|--data|-X\s*POST|-X\s*PUT|--body)'; then DATA=$(echo "$COMMAND" | sed -n 's/.*\(-d\|--data\)\s*["'"'"']*\([^"'"'"']*\).*/\2/p' | head -1) if [ -n "$DATA" ]; then RISK_OUTPUT=$(echo "$DATA" | "$DLP_SCAN" 2>&1) || RISK_SCORE=$? RISK_SCORE=${RISK_SCORE:-0} if [ "$RISK_SCORE" -ge 6 ]; then echo "🚫 DataGuard: BLOCKED sensitive data in outbound command" >&2 echo "$RISK_OUTPUT" >&2 "$AUDIT_LOG" --log-block "exec" "$CMD_BASE" ...[truncated 2522 chars]- Remediation
View remediation