T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:51
- Finding
- Uncontrolled Disclosure of Sensitive Context to an External Service and Anonymous Respondents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-74`; supporting example at `examples/usage.md:208-215` **Vulnerability Type**: External disclosure of potentially sensitive information **Risk Level**: High ### Vulnerable Code ```markdown The strangers answering have **no context beyond what you provide in the question**. Write self-contained questions. ## API Reference Use the `exec` tool to make API calls. The base URL is `https://api.ask-a-human.com`. ### Submit a Question ```bash curl -X POST https://api.ask-a-human.com/agent/questions \ -H "Content-Type: application/json" \ -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \ -d '{ "prompt": "Your question with full context", "type": "multiple_choice", "options": ["Option A", "Option B", "Option C"], "min_responses": 5, "timeout_seconds": 3600 }' ``` **Parameters:** - `prompt` (required): The question to ask. Include all necessary context. ``` The usage example explicitly demonstrates sending an internal security finding and personnel-related context: ```bash curl -X POST https://api.ask-a-human.com/api/questions \ -H "Content-Type: application/json" \ -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \ -d '{ "prompt": "I'\''m reviewing code and found a junior developer stored passwords with MD5 hashing instead of bcrypt. How should I phrase feedback that'\''s helpful but not condescending?\n\nContext: This is a code review comment that will be public to the team.", "type": "text", "audience": ["technical", "product"], "min_responses": 3, "timeout_seconds": 1800 }' ``` ### Technical Analysis The Skill instructs agents to include “full context” or “all necessary context” in requests sent to an externally operated API. The submitted prompts are intended to be viewed by a pool of random strangers. However, the instructions do not require: - Explicit user authorization before external disclosure. - Review or preview of the exact outbound prompt. - Re ...[truncated 2477 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before every external submission, including a preview of the exact prompt and a clear statement that anonymous strangers may view it. 2. Add a mandatory data-minimization step that strips unnecessary context. 3. Explicitly prohibit submission of: - Passwords, API keys, tokens, cookies, and other credentials. - Personal or regulated data. - Proprietary source code and confidential documents. - Non-public vulnerability details. - Internal identifiers unless strictly necessary. 4. Replace “full context” with “the minimum sanitized context necessary.” 5. Require agents to use placeholders or generalized descriptions, such as replacing employee roles, company names, file names, and implementation details with non-identifying terms. 6. Document the external service's retention, deletion, access, and privacy characteristics. 7. Provide an owner-controlled allowlist of acceptable information categories and disable the Skill for sensitive workspaces by default. 8. Add a final outbound-data check that blocks likely secrets and warns about confidential information before invoking `curl`. ]]>