other
Error
- Location
scripts/imgread.py:10- Finding
Undisclosed Transmission of User Images to a Third-Party Service
- Content
View full analysis
. 3. Obtain the absolute image path and run: python scripts/imgread.py -f imgpath ``` ### Technical Analysis The script opens the complete user-supplied image and sends it as a multipart upload to `kpp.ketop.cn`. It also transmits the API credential in the `X-API-Key` header. HTTPS protects the request in transit, but it does not prevent the receiving third party from accessing, processing, retaining, or logging the uploaded image. Remote image analysis is related to the declared table-extraction functionality. However, the primary Skill description does not clearly disclose that fallback recognition transfers the entire image to a named external provider. It also does not require informed confirmation immediately before the transfer. Images containing tables may include personal information, test records, business data, credentials, financial information, or other confidential material. Because the Skill first recommends built-in multimodal processing, unconditional fallback to an external upload is not the least-privileged approach. The external disclosure should be optional, transparent, and limited to data explicitly authorized by the user. ### Attack Path 1. A user supplies an image containing a table, potentially including confidential information. ...[truncated 1058 chars]- Remediation
View remediation