T09 · Insecure Skill Coding Practices
Error
- Location
- extract_session.py:143
- Finding
- Unredacted session and tool data is transmitted to an external AI service<![CDATA[ ## Vulnerability Details **File Location**: `extract_session.py:143-172`; additional exposure in `extract_session.py:273-292` **Vulnerability Type**: Sensitive data exposure through excessive external transmission **Risk Level**: High ### Vulnerable Code ```python def call_minimax_api(content: str, model: str) -> str: """Call MiniMax API for extraction.""" api_key = load_minimax_api_key() if not api_key: raise RuntimeError("MiniMax API key not found in auth-profiles.json") import urllib.request import urllib.error model_name = model.split("/")[-1] if "/" in model else model url = "https://api.minimaxi.com/v1/text/chatcompletion_v2" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } # v1.0.6: bumped from 8000 to 32000 to handle trajectory transcripts (which can be 25K+ chars for long sessions) truncated = content[:32000] if len(content) > 32000 else content payload = { "model": model_name, "messages": [ {"role": "system", "content": EXTRACTION_PROMPT}, {"role": "user", "content": f"Session transcript:\n{truncated}"}, ], "max_tokens": 1024, "temperature": 0.3, } req = urllib.request.Request( url, data=json.dumps(payload).encode(), headers=headers, method="POST" ) try: with urllib.request.urlopen(req, timeout=60) as resp: result = json.load(resp) ``` Trajectory processing also incorporates internal reasoning, tool arguments, and tool results: ```python elif btype == 'thinking': text = block.get('thinking', '').strip() if text: lines.append(f"[THINKING] {text[:500]}") elif btype == 'toolCall': name = block.get('name', block.get('toolName', '?')) args = block.get('arguments', block.get('input', {})) args_str = json.dumps(args, ensure_ascii=False)[:300] if args else '' lines.append(f"[TOOL_CALL] {name}( ...[truncated 2296 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply secret redaction before constructing the request, covering API keys, bearer tokens, passwords, private keys, cookies, authorization headers, and common credential formats. 2. Exclude thinking blocks, tool calls, and tool results by default. Expose them only through a separately documented opt-in option. 3. Minimize the payload by selecting only user and assistant conversational text relevant to memory extraction. 4. Require explicit consent that identifies the external provider before sending transcript content. 5. Add a local-only extraction mode for sensitive sessions. 6. Allow users to inspect the exact redacted payload before transmission. 7. Document the external endpoint, data categories, retention implications, and applicable provider policies. ]]>