T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/visual_rpa.py:217
- Finding
- Unredacted full-screen screenshots are transmitted to an external vision API## Vulnerability Details **File Location**: `scripts/visual_rpa.py`, lines 97–114, 217–237, 475–481, and 553–560 **Vulnerability Type**: External disclosure of sensitive screen content **Risk Level**: High ### Vulnerable Code ```python def capture_full(self) -> Image.Image: raw = self.sct.grab(self.sct.monitors[1]) return Image.frombytes("RGB", raw.size, raw.bgra, "raw", "BGRX") ``` ```python def to_base64(self, img: Image.Image, fmt: str = "JPEG", quality: int = 85) -> str: buf = io.BytesIO() if fmt == "JPEG": img.save(buf, format=fmt, quality=quality) else: img.save(buf, format=fmt) return base64.b64encode(buf.getvalue()).decode() ``` ```python class QwenVision: BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1" def __init__(self, model: str = "qwen-vl-max-latest", api_key: str = ""): self.client = OpenAI( api_key=api_key or os.getenv("DASHSCOPE_API_KEY", ""), base_url=self.BASE_URL, ) self.model = model def _call(self, system: str, img_b64: str, user_text: str, media_type: str = "image/jpeg", max_tokens: int = 1024) -> str: resp = self.client.chat.completions.create( model=self.model, max_tokens=max_tokens, messages=[ {"role": "system", "content": system}, { "role": "user", "content": [ {"type": "image_url", "image_url": { "url": f"data:{media_type};base64,{img_b64}"}}, {"type": "text", "text": user_text}, ], }, ], ) ``` ```python full_img = self.cap.capture_full() thumb = self.cap.resize(full_img, self.thumbnail_width) thumb_b64 = self.cap.to_base64(thumb) self.cap.save(thumb, f"step{s ...[truncated 2421 chars]
- Remediation
- ## Remediation Suggestions - Clearly disclose that screenshots are transmitted to DashScope and require explicit informed consent before the first transmission. - Capture only the target application window or the smallest necessary region instead of the complete monitor. - Redact password fields, authentication codes, notifications, clipboard managers, and unrelated application windows. - Add a preview mode showing exactly what will be transmitted. - Provide an offline or locally hosted vision-model option for sensitive workflows. - Disable verification screenshots where they are not required. - Document the external endpoint, provider retention policy, processing region, and privacy implications. - Fail safely when a target region cannot be isolated rather than falling back to transmitting the whole display.