other
- Location
SKILL.md:58- Finding
Uncontrolled Transmission of Potentially Sensitive Images to an External Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 58–93
Vulnerability Type: External disclosure of potentially sensitive image data
Risk Level: Mediumpython import requests, os, base64 SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.heybossai.com/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # Visual Question Answering (VQA) — encode image and send via chat with open("image.jpg", "rb") as f: img_b64 = base64.b64encode(f.read()).decode() result = pilot({ "type": "chat", "inputs": { "messages": [ { "role": "user", "content": [ {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{img_b64}"}}, {"type": "text", "text": "Describe the objects in this image and their positions."} ] } ] }, "prefer": "quality" }) answer = result["result"]["choices"][0]["message"]["content"]Technical Analysis
The documented integration reads the complete contents of a local image, Base64-encodes the bytes, and sends them to the third-party endpoint
https://api.heybossai.com/v1/pilot. Base64 is only a transport encoding and provides no confidentiality. Although HTTPS protects data in transit, the remote service receives the full image and accompanying prompt in plaintext at the application layer.External VLM processing is consistent with the skill's declared visual-question-answering functionality, and the destination is explicitly documented rather than hidden. Nevertheless, the example provides no controls for user consent, data classification, redaction, metadata removal, file- ...[truncated 2373 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before transmitting any local image to an external provider, clearly naming the destination and the data that will be sent.
- Default to local vision models when images are confidential or when external processing has not been approved.
- Add a data-classification gate that blocks images containing regulated, biometric, medical, credential, customer, or proprietary information unless an approved exception exists.
- Minimize submitted data by cropping to the required region, reducing resolution, redacting sensitive areas, and stripping EXIF and other metadata before upload.
- Document the provider's retention, training-use, subprocessors, residency, deletion, and privacy policies.
- Keep the API base URL fixed or enforce a strict HTTPS hostname allowlist. Disable redirects or verify every redirect destination before forwarding authorization headers.
- Use a narrowly scoped, revocable API credential dedicated to this skill. Never log the bearer token or complete request body.
- Add request and response hardening, including file-type and size limits,
r.raise_for_status(), response-size limits, schema validation, and safe error handling. - Clearly state that Base64 is not encryption and must not be treated as a security or anonymization measure.
- Add audit logging that records user authorization and destination without recording image contents, prompts containing sensitive data, or credentials.