T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:177
- Finding
- Unrestricted Third-Party Processing of Task Content## Vulnerability Details **File Location**: `SKILL.md`, lines 177-190 **Vulnerability Type**: Uncontrolled transmission of task content to an external AI service **Risk Level**: Medium ### Vulnerable Code ```python SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] def pilot(body: dict) -> dict: r = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # LLM reasoning / analysis result = pilot({"type": "chat", "inputs": {"messages": [{"role": "user", "content": "Analyze this data..."}]}, "prefer": "balanced"}) text = result["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The Skill instructs sub-agents requiring AI capabilities to submit task content to `https://api.heybossai.com/v1/pilot`. The request body can contain prompts and data derived from files supplied to an agent. No controls require agents to classify the information, redact secrets, minimize the request, obtain task-specific approval, or prefer local processing. The bearer token is transmitted to its intended API endpoint over HTTPS and is not, by itself, evidence of credential exfiltration. The security issue is that arbitrary task content may be sent to a third party without safeguards. Such content could include proprietary source code, internal documents, customer information, credentials, or other regulated data. Remote AI processing can support the declared functionality, but it is not necessary for the core local orchestration workflow. Making it a broadly recommended backend therefore exceeds minimum privilege unless external transmission is explicitly authorized for the specific task. ### Attack Path 1. A user supplies confidential content as part of an orchestration task. 2. The orchestrator places that content, or instructions de ...[truncated 1026 chars]
- Remediation
- ## Remediation Suggestions 1. Make remote AI processing opt-in for each task rather than the default recommendation. 2. Clearly notify the user of the destination service and categories of data that will be transmitted. 3. Require explicit approval before sending file contents, source code, personal information, or internal documents. 4. Add a local-only execution mode for orchestration and analysis. 5. Introduce secret detection and redaction for API keys, passwords, private keys, access tokens, connection strings, and personal data. 6. Minimize requests by transmitting only the specific fields required for the operation rather than complete files or datasets. 7. Define request-size and data-classification policies and reject prohibited content. 8. Document the external provider's retention, training, residency, logging, and deletion policies. 9. Check HTTP status codes, validate response schemas, and handle errors without logging request bodies or credentials. 10. Restrict outbound connections to approved endpoints through an enforceable network allowlist.