T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_kyc.py:174- Finding
Sensitive KYC Records and Verification Session Credentials Exposed Through Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run_kyc.py, lines 174-188
Vulnerability Type: Sensitive data exposure through console output and downstream logging
Risk Level: HighVulnerable Code
python elif args.command == "session": result = create_kyc_session(args.workflow_id, args.vendor_data, args.callback, args.language) print(json.dumps(result, indent=2)) print(f"\n--- Session Created ---") print(f"Session ID: {result.get('session_id')}") print(f"Verification URL: {result.get('url')}") print(f"\nSend the URL to your user to start verification.") elif args.command == "decision": if args.poll: print(f"Polling session {args.session_id} every {args.interval}s...") result = poll_decision(args.session_id, args.interval, args.max_wait) else: result = get_decision(args.session_id) print(json.dumps(result, indent=2))The documented decision structure in
SKILL.md, lines 207-225, demonstrates that the serialized response may contain highly sensitive fields:json { "session_id": "...", "status": "Approved", "features": ["ID_VERIFICATION", "LIVENESS", "FACE_MATCH"], "id_verifications": [{ "status": "Approved", "document_type": "PASSPORT", "issuing_country": "USA", "first_name": "John", "last_name": "Doe", "date_of_birth": "1990-01-15", "document_number": "ABC123456", "expiry_date": "2030-06-01", "gender": "M", "nationality": "USA", "mrz": "P<USADOE<<JOHN<<<<<<<<<<<..." }], "liveness_checks": [{ "status": "Approved", "method": "PASSIVE", "score": 92.5 }], "face_matches": [{ "status": "Approved", "score": 97.3 }], "aml_screenings": [], "warnings": [] }Technical Analysis
The
sessionanddecisionc ...[truncated 2282 chars]- Remediation
View remediation
Remediation Suggestions
- Remove full-response serialization from the default
sessionanddecisioncommand paths. - Print only the minimum required fields, such as a redacted session identifier and decision status.
- Redact at least:
session_token- Verification URLs or URL tokens
- Names and dates of birth
- Document and personal identification numbers
- MRZ data
- Biometric and liveness details
- If complete output is operationally necessary, require an explicit option such as
--show-sensitive, display a prominent warning, and disable that option in non-interactive or production environments by default. - Provide a secure output-file option that creates files with restrictive permissions rather than routing sensitive records through stdout.
- Document secure retention, access-control, deletion, and audit requirements for any exported KYC records.
- Add automated tests confirming that default command output never contains session tokens, document numbers, MRZ fields, dates of birth, or biometric data.
- Remove full-response serialization from the default