T09 · Insecure Skill Coding Practices
Warning
- Location
openapi.json:153- Finding
Excessive Collection and External Processing of Personal and Family Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:84-96,SKILL.md:142-145,openapi.json:153-181,openapi.json:225-238
Vulnerability Type: Excessive collection and external processing of personally identifiable information
Risk Level: MediumThe horoscope-generation operation requires users to provide a mobile number, both parents' names, a full name, and detailed birth information. Although birth date, time, and location are relevant to horoscope calculations, the reviewed documentation does not establish why the mobile number and parents' names are necessary. The data is submitted to an externally hosted API.
Vulnerable Code Snippets
SKILL.md:84-96:markdown **Request Body:** - `person_name` (string, required) - Person's full name - `father_name` (string, required) - Father's name - `mother_name` (string, required) - Mother's name - `mobile` (string, required) - 10-digit mobile number - `gender` (string, required) - Male or Female - `dob` (string, required) - Date of birth in DD/Mon/YYYY format - `hour` (string, required) - Birth hour (1-12) - `minute` (string, required) - Birth minute (00-59) - `am_pm` (string, required) - AM or PM - `country` (string, required) - Country code - `birth_place` (string, required) - Birth city name - `language_id` (string, optional, default: "1") - Language ID (1=Tamil) - `chart_type` (string, optional, default: "South Indian") - Chart type (South Indian or North Indian)openapi.json:153-181:json "person_name": { "type": "string", "title": "Person Name", "description": "Person's full name" }, "father_name": { "type": "string", "title": "Father Name", "description": "Father's name" }, "mother_name": { "type": "string", "title": "Mother Name", "description": "Mother's name" }, "mobile": { "type": "string", "title": "Mobile", "description": "10-digit mobile number" }, "gender": ...[truncated 3079 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
mobile,father_name, andmother_namefrom the required fields unless a documented and necessary business requirement exists. - Restrict the default request to the minimum horoscope-calculation inputs, such as birth date, birth time, birthplace, and chart preferences.
- Make nonessential identity fields optional and explain the precise purpose of every collected field.
- Present an explicit privacy disclosure before transmission, identifying the external processor, processing purpose, retention period, deletion procedure, and applicable user rights.
- Obtain affirmative user consent before sending personal or family information to the external service.
- Define authentication and authorization requirements in the OpenAPI specification and restrict access to generated documents.
- Use short-lived, unguessable, access-controlled download URLs rather than predictable or identity-derived filenames.
- Prevent sensitive fields from appearing in application logs, analytics, error messages, queue metadata, and generated filenames.
- Encrypt personal data in transit and at rest, establish retention limits, and provide a deletion mechanism.
- Document and enforce input length, format, and enumeration constraints to reduce malformed input and unnecessary data collection.
- Remove