T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bundle.js:83320- Finding
Sensitive recipient and CRM data is exposed in process output
- Content
View full analysis
{ console.log("\n\u2705 \u4EFB\u52A1\u6267\u884C\u6210\u529F"); console.log("\n\u7ED3\u679C:"); console.log(JSON.stringify(result, null, 2)); process.exit(0); }).catch((error) => { console.error("\n\u274C \u4EFB\u52A1\u6267\u884C\u5931\u8D25:", error.message); process.exit(1); }); ``` ### Technical Analysis The returned `taskInput` contains complete telephone numbers and may contain candidate names, evaluation scores, CRM attributes, campaign data, and arbitrary caller-supplied metadata. Serializing the complete result with `JSON.stringify` writes all of this data to standard output without redaction or field-level filtering. Standard output is commonly retained by CI systems, agent execution transcripts, container logging drivers, orchestration platforms, terminal recording systems, and centralized monitoring services. These systems may have wider access permissions and longer retention periods than the original task data. The exposure is not limited to telephone numbers because the parsing logic preserves full source objects under fields such as `metadata.candidates` and spreads arbitrary metadata into the task object. ### Attack Path ...[truncated 1362 chars]- Remediation
View remediation