T09 · Insecure Skill Coding Practices
- Location
SKILL.md:91- Finding
Unrestricted Transmission of Complete Document Contents to a Third-Party API
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 91–113
Vulnerability Type: Sensitive data exposure through unrestricted external transmission
Risk Level: HighVulnerable Code
python API_BASE = "https://api.heybossai.com/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # Extract document text, then call SkillBoss API Hub for summary analysis def analyze_document(doc_text: str) -> str: result = pilot({ "type": "chat", "inputs": { "messages": [ {"role": "system", "content": "You are a document analysis assistant. Extract the key points and produce a structured summary."}, {"role": "user", "content": f"Please analyze the following document content:\n\n{doc_text}"} ] }, "prefer": "balanced" }) return result["result"]["choices"][0]["message"]["content"]Technical Analysis
The
analyze_documentfunction inserts the complete extracted document text into a request sent tohttps://api.heybossai.com/v1/pilot. Although remote analysis is disclosed as part of the Skill's functionality, the implementation provides no explicit consent gate, local-only alternative, data-classification check, secret detection, personal-data redaction, content minimization, or transmission-size restriction.Consequently, all extracted content—including potentially confidential, personal, financial, legal, medical, or proprietary information—is eligible for transmission to a third party. Making full-content remote submission the standard analysis workflow exceeds the minimum privileges necessary because local extraction and some forms of local processing can be performed without external d ...[truncated 2234 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed, document-specific user consent before any content is transmitted. Clearly identify the destination, the data to be sent, and the purpose of processing.
- Default to local extraction and local analysis where feasible. Provide a clearly selectable local-only mode that performs no network requests.
- Apply content minimization. Send only the portions required for the requested operation rather than the complete document.
- Detect and redact credentials, API keys, personal information, financial identifiers, and other sensitive fields before transmission.
- Introduce data-classification controls that block remote processing of confidential or regulated documents unless an approved policy explicitly permits it.
- Enforce content-size and request-count limits. If chunking is necessary, preserve the same consent, redaction, and classification controls for every chunk.
- Restrict outbound traffic to an administratively approved domain allowlist and verify TLS certificates through the standard trusted certificate store.
- Document the external provider's retention, deletion, access, subprocessors, geographic processing, and model-training policies.
- Add robust response handling, including
r.raise_for_status(), expected content-type verification, response-schema validation, and safe error reporting that does not expose document content or credentials. - Avoid recording request bodies, authorization headers, extracted text, or provider responses in logs unless logs are explicitly secured and appropriately redacted.