T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/analyze.mjs:26
- Finding
- Unrestricted Transmission of Local File Contents to an External Service## Vulnerability Details **File Location**: `scripts/analyze.mjs:26-40` **Vulnerability Type**: Uncontrolled disclosure of local source code and potentially sensitive files to a third-party API **Risk Level**: High The documented `--file` workflow in `SKILL.md:15-16` allows a caller to provide a local file path. The implementation reads the entire file and transmits its contents to `https://logic.art/api/agent/analyze`. ```js if (args.file) { code = readFileSync(args.file, 'utf8'); if (!language) language = EXT_LANG[extname(args.file)] || 'unknown'; } if (!code) { console.error('Usage: analyze.mjs --code <code> | --file <path> [--language <lang>]'); process.exit(1); } const res = await fetch(API, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code, language: language || 'unknown' }), }); ``` ### Technical Analysis The `--file` argument accepts any path readable by the process. The script does not restrict the path to the intended project root, validate that the target is an approved source-code file, impose a file-size limit, scan or redact secrets, or require explicit confirmation before external transmission. After `readFileSync()` loads the complete file, its contents are placed in the `code` property of a JSON request and sent to a third-party endpoint. Although the documentation identifies LogicArt as the analysis provider, it does not prominently warn that complete local file contents leave the execution environment. This can result in accidental disclosure when an agent or user supplies a sensitive path while expecting a local code-review operation. Exploitation does not grant additional operating-system privileges: access remains limited to files readable by the account running the Skill. However, within that boundary, any readable text file may be submitted because extension recognition only controls the language label and doe ...[truncated 1440 chars]
- Remediation
- ## Remediation Suggestions 1. Display a clear warning that the complete file will be sent to `logic.art`, and require explicit confirmation before transmitting file contents. 2. Provide a deliberate noninteractive consent flag for trusted automation rather than silently transmitting by default. 3. Resolve and canonicalize the requested path, then require it to remain within an explicitly approved project root. 4. Permit only expected source-code extensions and reject credential files, private keys, environment files, and other known sensitive formats. 5. Scan for common secret patterns before transmission. Block the request or redact detected API keys, passwords, access tokens, private keys, and connection strings. 6. Add configurable file-size and request-size limits to prevent accidental submission of large or unintended files. 7. Offer a local-only analysis mode for confidential repositories and allow users to review the exact payload before submission. 8. Document the external service's data-processing, retention, deletion, and privacy policies adjacent to the usage instructions. 9. Prefer sending explicitly selected snippets instead of complete files whenever full-file context is unnecessary. 10. Log only metadata needed for diagnostics and ensure source contents or detected secrets are never written to logs.