T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_activity.js:47
- Finding
- Unfiltered ActivityWatch Data Exposes Sensitive Window Titles<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_activity.js:47-49` **Vulnerability Type**: Sensitive data exposure through unfiltered output **Risk Level**: Medium ### Complete Code Snippet ```javascript const result = await queryRes.json(); console.log('📦 Raw result:', JSON.stringify(result, null, 2)); ``` ### Technical Analysis The script prints the complete response returned by the local ActivityWatch API before applying the record-count and duration filters implemented later at lines 57-66. ActivityWatch records can include application names, window titles, document names, URLs, email subjects, project identifiers, and other sensitive information. Because Skill output is supplied to the AI model for analysis, this log statement can transmit the entire raw activity result into the model context. It defeats the intended restriction to the 50 longest records and the exclusion of activities shorter than one minute. Although `SKILL.md` warns users that window titles are processed by the AI model, the complete raw response exceeds the minimum information needed to produce an activity summary. The disclosure is not caused by an external network request in the script—the only configured endpoint is `127.0.0.1:5600`—but by emitting sensitive local data into the surrounding Agent workflow. ### Attack Path 1. ActivityWatch records application activity and associated window titles on the local system. 2. The Skill invokes `fetch_activity.js` to query the ActivityWatch API. 3. The API returns all matching events for the selected period. 4. The script serializes and prints the complete response at line 49. 5. The Agent captures the script output and submits it to the configured AI model for analysis. 6. Sensitive titles and other event fields are exposed without first applying aggregation, redaction, duration filtering, or the 50-record limit. ### Impact Assessment This issue does not grant operating-system privileges, code execution, or ...[truncated 448 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the raw response log entirely: ```javascript const result = await queryRes.json(); ``` 2. Aggregate records locally by application and duration before emitting any output. 3. Exclude window titles by default and require explicit user opt-in before including them. 4. Apply record-count, duration, and field-length limits before printing data. 5. Redact title patterns likely to contain URLs, email addresses, query strings, document paths, or other sensitive identifiers. 6. Provide a privacy-preserving mode that outputs only application names and total durations. 7. If diagnostic logging is required, make it an explicit debug option and ensure that it is disabled by default. ]]>