T09 · Insecure Skill Coding Practices
Warning
- Location
- resources/customers.json:9
- Finding
- Plaintext Customer Account Identifiers and Internal UIDs Bundled with the Skill## Vulnerability Details **File Location**: `resources/customers.json:9-81` **Vulnerability Type**: Plaintext sensitive customer data exposure **Risk Level**: Medium The packaged customer directory contains customer names, account identifiers, email addresses, telephone-like identifiers, and internal UIDs in plaintext. Representative records include: ```json {"name": "常熟农商行", "account": "13773065254", "id": "1087161152501898", "alias": ["常熟农商银行"]} {"name": "新网银行", "account": "dis.baicheng@gmail.com", "id": "1816018802153306"} {"name": "友邦", "account": "android-code@qq.com", "id": "1442504043238288", "alias": ["友邦保险"]} ``` ### Technical Analysis The complete production customer mapping is distributed as a static resource. Anyone with access to the Skill package can read the file without authenticating to the internal ticket system. The records expose relationships between customer organizations, support account names, and internal ticket UIDs. Although these values are used for customer matching and no automatic exfiltration mechanism was found, storing the entire directory locally violates data-minimization principles. Some account fields are formatted as personal telephone numbers or email addresses and may constitute personal or operationally sensitive information. ### Attack Path 1. An attacker obtains read access to the distributed Skill package or an installation directory containing it. 2. The attacker opens `resources/customers.json`; no decryption or authentication is required. 3. The attacker extracts customer names, account identifiers, aliases, and internal UIDs. 4. The extracted mappings are used for customer enumeration, targeted phishing, social engineering, or attempts to impersonate a customer in related support workflows. 5. If the attacker separately has access to the internal ticket system, the exposed UIDs may assist in selecting or submitting records under a targeted customer identity. ### Impact ...[truncated 519 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the production customer directory from the distributable Skill package. 2. Resolve customer records through an authenticated internal service that enforces user- and role-level authorization. 3. Return only the minimum fields required for the current ticket rather than the complete customer dataset. 4. Replace personal telephone numbers and email addresses with non-personal, purpose-specific customer identifiers where possible. 5. Encrypt sensitive cached data at rest and ensure encryption keys are not bundled with the Skill. 6. Apply restrictive file permissions if a local cache is operationally unavoidable. 7. Define retention and deletion policies for cached customer records. 8. Audit access to customer lookups and alert on bulk enumeration. 9. Review whether the disclosed UIDs are accepted as authorization signals elsewhere; if they are, replace that design with server-side authorization checks.