other
Warning
- Location
SKILL.md:88- Finding
Operational and Incident Data Sent to an Unverified External Tunnel
- Content
View full analysis
" \ -d '{ "events": [ {"id":"e1","type":"load_spike","module":"infra"}, {"id":"e2","type":"heartbeat_timeout","module":"governance"}, {"id":"e3","type":"trust_decay","module":"trust_engine"}, {"id":"e4","type":"cert_blocked","module":"certification"} ], "mode": "responsibility_chain", "protocols": [ {"name":"heartbeat_timeout_30s","module":"governance","threshold":30}, {"name":"trust_decay_curve","module":"trust_engine","threshold":12}, {"name":"cert_threshold_60","module":"certification","threshold":60} ] }' ``` ### Technical Analysis The documented workflow submits event sequences, module names, protocol names, and security-relevant thresholds to an externally controlled `trycloudflare.com` endpoint. Cloudflare Tunnel hostnames of this form do not provide users with a stable, project-specific service identity. Although transport encryption is provided by HTTPS, it does not establish that the remote operator is authorized to receive potentially sensitive operational information. The Skill provides no warning about disclosure, retention policy, redaction requirement, endpoint ownership, or data-deletion process. The package contains no local implementation of the claimed analyzer. Consequently, users following the instructions must effectively delegate analysis to the remote service. ### Attack Path 1. A user follows the documented causal-analysis example. 2. The user replaces the sample events and protocols with actual incident information. 3. The request transmits internal module names, failure events, control thresholds, ...[truncated 785 chars]- Remediation
View remediation