T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:12- Finding
Raw AI Prompts and Responses Are Transmitted to a Remote Service Without Adequate Privacy Controls
- Content
View full analysis
Vulnerability Details
File Location:
src/index.ts:12-25,src/index.ts:45-100, andsrc/index.ts:137-179
Vulnerability Type: Uncontrolled transmission of potentially sensitive AI interaction data
Risk Level: HighVulnerable Code
ts async function callAPI(path: string, body: Record<string, unknown>): Promise<unknown> { const headers: Record<string, string> = { "Content-Type": "application/json" }; if (API_KEY.startsWith("pk_live_")) { headers["x-api-key"] = API_KEY; } if (ANON_KEY) { headers["Authorization"] = `Bearer ${ANON_KEY}`; } const res = await fetch(`${API_BASE}/${path}`, { method: "POST", headers, body: JSON.stringify(body), }); if (!res.ok) { const text = await res.text(); throw new Error(`ProofAI API error ${res.status}: ${text}`); } return res.json(); }The certification workflow submits the complete prompt and generated response:
ts const compressed = (await callAPI("compress", { prompt, options: { compressionLevel: "medium" } })) as { id: string; compressedDsl: string }; const analysis = (await callAPI("analyze", { executionId: execution.id, analysisText: execution.output, })) as { id: string; cognitiveHash: string; metrics: { nodeCount: number; consistencyScore: number }; }; const signature = (await callAPI("sign", { executionId: execution.id, rawOutput: execution.output, modelProvider: execution.metadata.provider, modelId: execution.metadata.model, modelVersion: "latest", modelParameters: { temperature }, executionMetrics: { tokens: execution.metadata.tokens.total }, requesterInfo: { source: "mcp-server" }, timestamps: { request_received: new Date().toISOString() }, })) as { signatureId: string }; const bundle = (await callAPI("bundle", { promptId: compressed.id, executionId: execution.id, analysisI ...[truncated 3584 chars]- Remediation
View remediation
Remediation Suggestions
- Clearly disclose, in both
README.mdandSKILL.md, every category of data sent remotely, the destination, subprocessors, storage location, retention period, and deletion procedure. - Require explicit informed confirmation before transmitting raw prompts or responses, particularly when a tool is invoked automatically by an Agent.
- Implement client-side secret detection and configurable redaction for credentials, tokens, personal data, and other sensitive patterns.
- Compute evidence hashes and signatures locally where possible, and transmit only cryptographic digests and minimum necessary metadata for blockchain anchoring.
- Provide a local-only or hash-only certification mode.
- Allow organizations to configure data classification policies that prevent restricted content from being submitted.
- Avoid sending the same raw response separately to analysis, signing, and bundling endpoints unless each transmission is strictly necessary.
- Add request-size limits and structured validation to reduce unintended bulk disclosure.
- Document whether blockchain transactions contain only hashes and ensure that raw prompts and responses can never be placed on a public ledger.
- Clearly disclose, in both