T09 ยท Insecure Skill Coding Practices
Error
- Location
- scripts/v4/synthesize-proposal.sh:480
- Finding
- Conversation excerpts are transmitted to a remote LLM under the default configuration<![CDATA[ ## Vulnerability Details **File Location**: `config.yaml:18`; `scripts/v4/semantic-analyze.sh:519-528`; `scripts/v4/synthesize-proposal.sh:480-509`; `scripts/v4/llm-call.sh:182-204` **Vulnerability Type**: Sensitive information disclosure through remote processing **Risk Level**: High ### Vulnerable Code Default remote provider: ```yaml llm: provider: "anthropic" # anthropic | openai | ollama | none ``` Raw user-message excerpts are retained in analysis results: ```python if effective_confidence >= 0.5: severity = 'high' if confidence >= 0.85 else ('medium' if confidence >= 0.7 else 'low') context_preview = clean_text[:120].replace('\n', ' ') events.append({ 'session': session['session_id'], 'agent': session.get('agent', ''), 'pattern': ptype, 'context': context_preview, 'severity': severity, 'confidence': round(effective_confidence, 2), 'directed_at_agent': is_directed_at_agent, 'timestamp': msg.get('timestamp', ''), }) ``` The excerpts are included in the LLM prompt: ```bash _ANA_SUMMARY=$(jq -r '{ sessions: .sessions_analyzed, quality: .quality_score, insights: (.key_insights // [] | .[0:5]), top_frustration: (.frustration_events // [] | .[0:3] | map({pattern, severity, context})), exec_loops: (.exec_loops // [] | .[0:3] | map({command_base, count})), violations: (.rule_violations // [] | .[0:3] | map({rule, violation, count})) }' "$ANALYSIS_FILE" 2>/dev/null || echo '{}') _LLM_PROMPT="You are reviewing a self-evolving AI agent's weekly behavior analysis. Based on the following structured data, provide 2-3 specific, actionable improvement proposals. Analysis data: ${_ANA_SUMMARY}" _LLM_RESPONSE=$(echo "$_LLM_PROMPT" | bash "$LLM_CALL_SH" \ --provider "${_SEA_LLM_PROVIDER}" \ --system "You are an expert AI behavior analyst. Generate specific, evidence-based AGENTS.md improvement proposals." \ 2>/tmp/sea-v4/llm-call.log) ``` The resulting p ...[truncated 2237 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the default provider to `ollama` or `none`. 2. Require explicit, informed consent before enabling Anthropic, OpenAI, or another remote provider. 3. Remove raw `context` values from remote prompts unless strictly necessary. 4. Add a redaction pass for API keys, access tokens, passwords, email addresses, URLs, filesystem paths, and other identifiers. 5. Provide a preview showing exactly what will be transmitted before remote processing is enabled. 6. Add an explicit configuration option such as `allow_remote_transcript_context: false`. 7. Update `SECURITY.md` to document every remote endpoint and the precise data fields sent. 8. Add automated tests proving that remote prompts contain no raw transcript text when remote disclosure is disabled. ]]>