T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/android_agent.py:88
- Finding
- Potentially Sensitive Android Screenshots Can Be Sent over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/android_agent.py:15`, `scripts/android_agent.py:88-124`, and `scripts/android_agent.py:147-194` **Vulnerability Type**: Insecure transmission of sensitive screen data **Risk Level**: High ### Vulnerable Code ```python VLM_BASE_URL = os.getenv("VLM_BASE_URL", "http://127.0.0.1:13009/v1") ``` ```python img_path = "vlm_temp_vision.jpg" d.screenshot(img_path) with open(img_path, "rb") as f: base64_img = base64.b64encode(f.read()).decode('utf-8') client = OpenAI(api_key=VLM_API_KEY, base_url=VLM_BASE_URL) response = client.chat.completions.create( model=VLM_MODEL_NAME, messages=[ {"role": "user", "content": [ {"type": "text", "text": prompt}, {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{base64_img}"}} ]} ], temperature=0, response_format={"type": "json_object"} ) ``` The same behavior is present in the planning function: ```python img_path = "vlm_plan_vision.jpg" d.screenshot(img_path) with open(img_path, "rb") as f: base64_img = base64.b64encode(f.read()).decode('utf-8') client = OpenAI(api_key=VLM_API_KEY, base_url=VLM_BASE_URL) response = client.chat.completions.create( model=VLM_MODEL_NAME, messages=[ {"role": "user", "content": [ {"type": "text", "text": prompt}, {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{base64_img}"}} ]} ], temperature=0, response_format={"type": "json_object"} ) ``` ### Technical Analysis The Skill captures the entire Android screen and includes the image in an OpenAI-compatible API request. Android screenshots can contain highly sensitive information, including private messages, contact names, account balances, authentication codes, email addresses, notification contents, and information from unrelated applications. Base64 encoding is required to embed the image in a data URL, but it does no ...[truncated 2229 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for every non-loopback VLM endpoint. 2. Reject unsupported URL schemes and validate the endpoint before creating the client. 3. Permit plaintext HTTP only for explicit loopback addresses such as `127.0.0.1`, `::1`, and `localhost`. 4. Consider maintaining an administrator-approved endpoint allowlist. 5. Clearly notify users that complete screenshots and task descriptions are sent to the configured VLM service. 6. Obtain explicit consent before using a remote model with screen data. 7. Redact notification areas, password fields, one-time codes, and other sensitive regions where technically possible. 8. Prefer local VLM processing for sensitive workflows. 9. Add certificate verification guidance and prohibit disabling TLS verification. 10. Minimize captures by taking screenshots only when required for the requested action. 11. Add tests confirming that remote `http://` URLs are rejected. Example validation logic should parse the URL, verify its scheme and hostname, and fail closed when a non-loopback host does not use HTTPS. ]]>