T09 · Insecure Skill Coding Practices
Warning
- Location
job_search_apply.py:17- Finding
Applicant PII Transmitted to an External AI Service Without Adequate Data Minimization
- Content
View full analysis
dict: r = requests.post( f"{_API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` The compatibility prompt includes applicant identity information: ```python prompt = ( f"Analyze this job posting and applicant profile for compatibility.\n\n" f"Job Title: {job.get('title')}\nCompany: {job.get('company')}\n" f"Description: {job.get('description', 'N/A')}\n\n" f"Applicant: {profile.full_name}, {profile.years_experience or 0} years experience.\n\n" f"Respond with JSON only: " f'{{ "match_score": <0.0-1.0>, "key_matches": [...], "missing_requirements": [...], "recommended": }}' ) result = _pilot({ "type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefer": "balanced", }) ``` The cover-letter prompt includes additional identifying information: ```python prompt = ( f"Write a professional, personalized cover letter for the following job application.\n\n" f"Job Title: {job.get('title')}\nCompany: {job.get('company')}\n" f"Job Description: {job.get('description', 'N/A')}\n\n" f"Applicant Name: {profile.full_name}\n" f"Years of Experience: {profile.years_experience or 'several'}\n" f"LinkedIn: {profile.linkedin_url or 'N/A'}" f"{template_hint}\n\n" f"Return only the cover letter text, no extra commentary." ) result = _pilot({ "type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefe ...[truncated 2197 chars]- Remediation
View remediation