T09 · Insecure Skill Coding Practices
- Location
references/vector.md:87- Finding
Public-Read OSS Guidance Can Expose Sensitive User Media
- Content
View full analysis
Vulnerability Details
File Location:
references/vector.md, lines 87-101 and 362-367
Vulnerability Type: Unnecessary public exposure of user-supplied media
Risk Level: HighVulnerable Code and Guidance
markdown | Media Type | Size | Strategy | mm_value Example | |--------------------------|------|----------|------------------| | **Small image** (< 60KB) | Small | Convert to base64 data URI | `"data:image/jpeg;base64,/9j/4AAQ..."` | | **Large image** (≥ 60KB) | Large | Upload to OSS (public read), pass URL | `"https://your-bucket.oss-cn-hangzhou.aliyuncs.com/img/large.jpg"` | | **Video** | Any | Upload to OSS (public read), pass URL | `"https://your-bucket.oss-cn-hangzhou.aliyuncs.com/video/demo.mp4"` | | **Audio** | Any | Upload to OSS (public read), pass URL | `"https://your-bucket.oss-cn-hangzhou.aliyuncs.com/audio/speech.wav"` | ```python # Large video/audio/image → upload to OSS first, then use public-read URL mm_value_oss_url = "https://your-bucket.oss-cn-hangzhou.aliyuncs.com/video/demo.mp4"markdown - **Large images / video / audio**: upload to OSS with **public-read** access, then pass the URL in the `mm_value` field.Technical Analysis
The Skill instructs users to make large images, videos, and audio files publicly readable in Alibaba Cloud OSS before passing their URLs to a multimodal embedding function. Public-read access removes object-level authentication and allows anyone possessing the URL to retrieve the object.
This exceeds the minimum privileges required for the declared multimodal embedding workflow. Media retrieval should instead use a private object with a narrowly scoped, short-lived signed URL or another authenticated service-to-service mechanism. Public access should not be the default, particularly because user media may contain confidential, personal, biometric, proprietary, or regulated information.
The finding is not covert exfiltration to an a ...[truncated 2056 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all recommendations to configure OSS buckets or objects as public-read.
- Keep media objects private by default and generate short-lived signed URLs limited to:
- One specific object.
- Read-only access.
- The shortest lifetime sufficient for embedding retrieval.
- Prefer authenticated service-to-service access when supported by the embedding provider, such as a narrowly scoped RAM role or temporary STS credentials.
- Warn users that source media and URLs may be transmitted to and processed by their configured Milvus service and embedding provider.
- Require explicit user confirmation before any workflow that intentionally makes an object public.
- Avoid returning or logging signed or source URLs unless necessary. Exclude
mm_valuefromoutput_fieldsby default when it contains sensitive references. - Revoke temporary access and delete staging objects after embedding when retention is unnecessary.
- Apply least-privilege OSS policies and deny public ACLs at the bucket or account level where feasible.
- Add guidance for validating URL schemes and approved storage domains before server-side media retrieval.
- Replace the insecure documentation with guidance such as:
markdown Large images, videos, and audio must remain private. Provide a short-lived, read-only signed URL scoped to the single object, or use an authenticated service-to-service retrieval method supported by the embedding provider. Do not enable public-read access for sensitive media.