T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run_kyc.py:174
- Finding
- Sensitive KYC Records and Verification Session Credentials Exposed Through Standard Output## Vulnerability Details **File Location**: `scripts/run_kyc.py`, lines 174-188 **Vulnerability Type**: Sensitive data exposure through console output and downstream logging **Risk Level**: High ### Vulnerable Code ```python elif args.command == "session": result = create_kyc_session(args.workflow_id, args.vendor_data, args.callback, args.language) print(json.dumps(result, indent=2)) print(f"\n--- Session Created ---") print(f"Session ID: {result.get('session_id')}") print(f"Verification URL: {result.get('url')}") print(f"\nSend the URL to your user to start verification.") elif args.command == "decision": if args.poll: print(f"Polling session {args.session_id} every {args.interval}s...") result = poll_decision(args.session_id, args.interval, args.max_wait) else: result = get_decision(args.session_id) print(json.dumps(result, indent=2)) ``` The documented decision structure in `SKILL.md`, lines 207-225, demonstrates that the serialized response may contain highly sensitive fields: ```json { "session_id": "...", "status": "Approved", "features": ["ID_VERIFICATION", "LIVENESS", "FACE_MATCH"], "id_verifications": [{ "status": "Approved", "document_type": "PASSPORT", "issuing_country": "USA", "first_name": "John", "last_name": "Doe", "date_of_birth": "1990-01-15", "document_number": "ABC123456", "expiry_date": "2030-06-01", "gender": "M", "nationality": "USA", "mrz": "P<USADOE<<JOHN<<<<<<<<<<<..." }], "liveness_checks": [{ "status": "Approved", "method": "PASSIVE", "score": 92.5 }], "face_matches": [{ "status": "Approved", "score": 97.3 }], "aml_screenings": [], "warnings": [] } ``` ### Technical Analysis The `session` and `decision` c ...[truncated 2282 chars]
- Remediation
- ## Remediation Suggestions 1. Remove full-response serialization from the default `session` and `decision` command paths. 2. Print only the minimum required fields, such as a redacted session identifier and decision status. 3. Redact at least: - `session_token` - Verification URLs or URL tokens - Names and dates of birth - Document and personal identification numbers - MRZ data - Biometric and liveness details 4. If complete output is operationally necessary, require an explicit option such as `--show-sensitive`, display a prominent warning, and disable that option in non-interactive or production environments by default. 5. Provide a secure output-file option that creates files with restrictive permissions rather than routing sensitive records through stdout. 6. Document secure retention, access-control, deletion, and audit requirements for any exported KYC records. 7. Add automated tests confirming that default command output never contains session tokens, document numbers, MRZ fields, dates of birth, or biometric data.