T09 · Insecure Skill Coding Practices
Warning
- Location
- handler.ts:92
- Finding
- Potentially Sensitive Source Material Is Transmitted to a Third-Party API Without Local Redaction<![CDATA[ ## Vulnerability Details **File Location**: `handler.ts:14-18`, `handler.ts:92-101` **Vulnerability Type**: Unredacted third-party transmission of potentially sensitive data **Risk Level**: Medium ### Vulnerable Code ```typescript interface ScanInput { repo_url?: string; skill_slug?: string; code?: string; dependencies?: Record<string, string>; skill_md?: string; } ``` ```typescript // Call Claw0x Gateway API const response = await fetch('https://api.claw0x.com/v1/call', { method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ skill: 'security-scanner', input }) }); ``` ### Technical Analysis The skill accepts source code, dependency information, and SKILL.md content as fields of `ScanInput`. It then serializes the complete input object and sends it to `https://api.claw0x.com/v1/call`. Source material submitted for security scanning may contain API keys, passwords, private endpoints, proprietary algorithms, internal comments, or other confidential information. The local implementation does not inspect the content for secrets, redact likely credentials, restrict transmitted fields, display an upload preview, or require explicit confirmation before direct-code submission. The network request is necessary for the declared API-based scanning functionality and is documented in `SKILL.md`. The documentation also advises using local tools where proprietary code cannot leave the network. Therefore, this behavior is not concealed and does not establish malicious exfiltration. The security concern is that the implementation relies entirely on callers to recognize and remove sensitive content before transmission. The `CLAW0X_API_KEY` is also transmitted in the authorization header, but this is necessary for authentication and is sent only to the documented HTTPS API endpoint. The implementation reads only that named environment variable and does not ...[truncated 1633 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before uploading direct source code, clearly identifying the destination hostname and the fields that will be transmitted. 2. Add local secret detection and redact common credential formats, private keys, authorization tokens, connection strings, and password assignments before serialization. 3. Provide an upload preview showing the exact files, fields, and approximate payload size that will leave the local environment. 4. Support field and file allowlists so callers can submit only the minimum data required for a scan. 5. Reject or warn on high-confidence secret findings unless the user explicitly overrides the warning. 6. Offer a local or self-hosted scanning mode for proprietary repositories and environments where source code cannot cross the network boundary. 7. Document the external service's retention, access-control, encryption, logging, deletion, and model-training policies. 8. Minimize API-key privileges, support key rotation, and avoid including request authorization data in logs or propagated error messages. ]]>