T09 · Insecure Skill Coding Practices
Error
- Location
- smart_router.py:124
- Finding
- Full User Prompts Transmitted over Plaintext HTTP to a Hard-Coded LAN Host<![CDATA[ ## Vulnerability Details **File Location**: `smart_router.py:28`, `smart_router.py:124-145` **Vulnerability Type**: Plaintext transmission of potentially sensitive user data **Risk Level**: High ### Vulnerable Code ```python class SmartRouter: def __init__(self, ollama_host: str = "http://192.168.10.14:11434"): self.ollama_host = ollama_host self.judge_model = "deepseek-r1:1.5b" ``` ```python response = requests.post( f"{self.ollama_host}/api/generate", json={ "model": self.judge_model, "prompt": f"""请判断以下用户请求是简单请求还是复杂请求： 用户请求：{prompt} 简单请求通常包括：问候、简单查询、文件操作、提醒设置、简短回答等。 复杂请求通常包括：代码编写、复杂分析、创意写作、详细解释、逻辑推理等。 请只回答一个字："简单" 或 "复杂"，不要其他任何内容。""", "stream": False, "options": { "temperature": 0.1, "max_tokens": 10 } }, timeout=5 ) ``` ### Technical Analysis When regex-based classification cannot determine the complexity of a request, `judge_with_model()` embeds the complete user prompt in a JSON request and sends it to the fixed address `192.168.10.14:11434`. The connection uses unauthenticated plaintext HTTP. It therefore provides neither transport confidentiality nor server identity verification. User prompts can contain credentials, source code, personal information, internal file contents, or confidential operational instructions. Such content can be observed by an attacker with access to the local network path or received by an unauthorized service controlling the configured IP address. Using a model to classify ambiguous prompts is consistent with the declared routing functionality. However, forwarding the complete raw prompt to a hard-coded network host without consent, redaction, authentication, or a secure transport exceeds the minimum privileges necessary for classification. The Skill documentation mentions an Ollama service but does not clearly warn that complete prompts may be transmitted to this fixed LAN host. ### Attack Path 1. A user su ...[truncated 1098 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default the Ollama endpoint to a loopback address such as `http://127.0.0.1:11434`, not a developer-specific LAN address. 2. Require the endpoint to be explicitly configured by the user through a configuration file or environment variable. 3. Do not transmit prompts until the user has been clearly informed of, and has consented to, the data flow. 4. Use HTTPS with certificate verification and authenticated access whenever the endpoint is not strictly local. 5. Provide an enforced offline mode that only uses deterministic local classification. 6. Prefer sending derived features, such as prompt length and locally detected categories, rather than the complete prompt. 7. Detect and redact likely credentials, tokens, private keys, and other sensitive values before any model request. 8. Reject non-loopback plaintext endpoints by default and require an explicit security override for trusted private networks. 9. Document the exact recipient, transmitted fields, retention assumptions, and conditions under which prompt transmission occurs. ]]>