T09 · Insecure Skill Coding Practices
- Location
SKILL.md:43- Finding
Unconsented Disclosure of User-Provided Text to a Third-Party Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:43-45,SKILL.md:57-58, andSKILL.md:103-104
Vulnerability Type: Third-party transmission of potentially sensitive user content
Risk Level: MediumVulnerable Code Snippets
macOS and Linux instructions:
bash curl -s "https://api.gptzero.me/v1/check" \ -H "Content-Type: application/json" \ -d '{"text": "待检测文本"}'Windows PowerShell instructions:
powershell $body = @{"text" = "待检测文本"} | ConvertTo-Json Invoke-RestMethod -Uri "https://api.gptzero.me/v1/check" -Method POST -Body $body -ContentType "application/json"The decision tree also recommends using external detection:
text 3. 是否需要检测？ → 是 → 用 GPTZero / Originality.ai 初检Technical Analysis
The skill instructs the agent or user to submit the full text being processed to the GPTZero API. It does not require explicit consent before transmission, warn that data will leave the local environment, recommend removing confidential information, or describe the provider's storage and retention practices.
The skill accepts arbitrary user-supplied text, which could contain personal information, proprietary documents, credentials, unpublished material, or regulated data. Sending that text in a plaintext JSON request body over HTTPS protects it in transit but does not prevent the receiving service from reading, storing, logging, or otherwise processing it.
The decision tree makes external detection part of the normal workflow. Although local detection is mentioned elsewhere, it is not established as the privacy-preserving default. The same issue exists in both the shell and PowerShell instructions.
Attack Path
- A user supplies sensitive or proprietary text for rewriting.
- The user or agent requests detection, or follows the documented decision tree.
- The skill's example command places the complete text into the JSON request body.
- The command transmits that content to
api.gptzero.me. - The external pr ...[truncated 1057 chars]
- Remediation
View remediation
Remediation Suggestions
- Make local detection the default and require an explicit opt-in before contacting any external service.
- Display a clear warning immediately before transmission that identifies the destination and explains that the submitted text will leave the local environment.
- Require affirmative user consent for each external submission rather than inferring consent from a general detection request.
- Detect or prompt for removal of credentials, personal information, customer data, proprietary documents, and other sensitive content.
- Send only the minimum necessary excerpt when full-document submission is not required.
- Document the provider's privacy, retention, logging, training-use, and data-residency policies.
- Provide configuration controls that allow administrators to disable external detection entirely.
- Update the workflow to distinguish local and remote detection explicitly, for example:
text Detection requested: - Default: run local detection. - External service: explain the destination and privacy implications, redact sensitive data, and obtain explicit consent before transmission.- Avoid claiming or implying that a third-party check is privacy-neutral merely because HTTPS is used; HTTPS protects transport but not data from the receiving provider.