T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:103- Finding
User-provided images are transmitted to an external backend without explicit consent or destination validation
- Content
View full analysis
/api/analysis/upload" \ -F "file=@/tmp/foodloop_upload.jpg" \ -F "condition=segar" ``` `references/api_workflow.md:35-40`: ```bash curl -s -X POST "https:///api/analysis/upload" \ -F "file=@/tmp/foodloop_photo.jpg" \ -F "condition=segar" ``` ### Technical Analysis The Skill instructs the Agent to upload a chat-supplied image to an external FoodLoop backend. The reference identifies `https://foodrecycler.onrender.com` as a live backend, while the main workflow also supports a dynamically discovered `` host. Remote image processing is relevant to the declared analysis functionality, so network access itself is justified. However, the implementation lacks safeguards necessary to limit that access: - It does not require explicit user confirmation before transmitting the image. - It does not clearly disclose the final destination host at upload time. - It does not validate a discovered backend against an approved host allowlist. - It does not warn that the image and any embedded metadata may be processed or retained by a third party. - It does not minimize the uploaded data by stripping metadata or creating a sanitized derivative. Consequently, the behavior can exceed the user's reasonable expectations even though it supports the declared function. ### Attack Path 1. A user supplies an image in chat, potentially containing private objects, people, documents, location metadata, or other sensitive content. 2. The Agent follows the Skill and stores the image in a temporary file. 3. The Skill obtains or accepts a backend URL without enforcing a trusted-host allowlist. 4. The Agent issues a multipart HTTP request containing the complete imag ...[truncated 757 chars]- Remediation
View remediation