T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:196
- Finding
- Automatic Diagram Upload to a Mismatched Third-Party API Endpoint## Vulnerability Details **File Location**: `SKILL.md`, lines 196-204 **Vulnerability Type**: Unintended third-party data disclosure caused by insecure integration configuration **Risk Level**: Medium ### Vulnerable Code Snippet The following is a faithful English rendering of the complete affected section: ```markdown ### ProcessOn (API key required) If the user has configured a ProcessOn API key through the `PROCESSON_API_KEY` environment variable, prioritize the ProcessOn API: 1. Convert the diagram into a format supported by ProcessOn. 2. Call `POST https://open.pingcode.com/v1/graph` to upload it and generate an image. 3. Return the ProcessOn online link for collaboration. If no ProcessOn API key is configured, output Draw.io XML by default. ``` ### Technical Analysis The Skill describes the remote integration as ProcessOn but instructs the Agent to upload diagram data to `open.pingcode.com`, which is a different service domain. This provider-to-endpoint mismatch prevents a user from reliably identifying the recipient of the uploaded information. The integration is selected automatically whenever `PROCESSON_API_KEY` is detected. The instructions do not require explicit confirmation before transmission and do not define: - Which diagram fields or user inputs are transmitted. - Whether confidential content must be removed before upload. - How the API key is placed in the request. - Whether request data or credentials may be logged. - The external service's retention and access policies. - How the endpoint's ownership and authenticity are verified. Diagram content may contain internal architecture, database names, service relationships, approval processes, external integrations, or organizational responsibilities. Automatically sending such content to an ambiguously identified service creates a confidentiality risk. The unspecified authentication procedure also creates a potential credential-exposure r ...[truncated 1840 chars]
- Remediation
- ## Remediation Suggestions 1. Verify the provider's official API documentation and replace the endpoint with an authenticated, provider-owned ProcessOn domain. If `open.pingcode.com` is intentionally used, identify it accurately and document the relationship between the services. 2. Default to local Draw.io generation. Do not enable remote upload merely because an environment variable exists. 3. Before every remote upload, display the exact recipient domain and categories of data being sent, then require explicit user confirmation. 4. Apply data minimization by excluding prompts, metadata, credentials, and diagram fields that are not required by the remote API. 5. Send API keys only through the provider's documented authorization header over HTTPS. Never place credentials in URLs, diagram XML, filenames, returned links, logs, or error messages. 6. Validate the destination against a fixed allowlist and reject redirects to unapproved domains. 7. Document retention, deletion, access-control, and privacy behavior for uploaded diagrams. 8. Handle remote failures securely by falling back to local generation without exposing credentials or complete sensitive response bodies. 9. Add tests that verify the destination hostname, ensure authorization headers are redacted from logs, and confirm that uploads cannot occur without affirmative consent.