T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:429
- Finding
- Authenticated Knowledge-Base Content Is Exposed to the Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 429-464 **Vulnerability Type**: Sensitive data exposure through the AI agent and tool context **Risk Level**: Medium ### Complete Code Snippet ```javascript const BOOK_ID = /* ... */; const slugs = /* 本批次的 slug 列表，如 ['slug1', 'slug2', ...] */; const titles = /* 对应的 title 列表 */; const results = await Promise.all(slugs.map(async (slug, i) => { for (let retry = 0; retry < 3; retry++) { try { const r = await fetch(`/api/docs/${slug}?book_id=${BOOK_ID}`, { credentials: 'include', headers: { 'Accept': 'application/json' } }); if (r.status === 429) { await new Promise(ok => setTimeout(ok, 2000 * (retry + 1))); continue; } const data = await r.json(); const content = data.data?.content || data.data?.body_lake || data.data?.body_html || ''; return { slug, title: titles[i], md: window._lakeToMarkdown(content, titles[i]), ok: true }; } catch (e) { if (retry === 2) return { slug, title: titles[i], md: `# ${titles[i]}\n\n(导出失败: ${e.message})\n`, ok: false }; await new Promise(ok => setTimeout(ok, 1000)); } } })); JSON.stringify(results); ``` The surrounding instructions require each result batch to be returned through `evaluate_script` to the agent before the agent writes it to local files. ### Technical Analysis The Skill legitimately needs authenticated read access to the selected Yuque knowledge base to perform an export. However, it uses the browser's authenticated session through `credentials: 'include'`, retrieves complete document bodies, converts them to Markdown, serializes the Markdown into JSON, and returns that JSON to the AI agent. Routing full document bodies through the agent context exceeds the minimum privilege required for a local export. Fetching, conversion, and file writing could instead occur within a trusted local process, while the agent receives only operational metadata such as ...[truncated 2770 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Keep document bodies out of the agent context** - Implement fetching, conversion, and file writing in a trusted local helper. - Return only document counts, identifiers, success or failure status, hashes, and sanitized error messages to the agent. - Do not serialize complete Markdown documents into MCP responses unless the user explicitly requests inspection of a specific document. 2. **Enforce a strict untrusted-content boundary** - Mark all retrieved Yuque content as untrusted data. - Explicitly prohibit interpreting document text as agent instructions. - Ensure document content cannot select tools, change output paths, modify commands, or override safety constraints. 3. **Require informed user consent** - Before processing private repositories, explain that document contents may otherwise pass through the AI context. - Require explicit confirmation for any operation that exposes document bodies to the model. - Display the repository and destination path before export begins. 4. **Minimize authenticated access** - Restrict requests to the exact Yuque origin and APIs needed for the selected repository. - Validate the supplied URL, repository identifier, book identifier, and document slugs. - Do not expose session cookies, authentication headers, or raw API responses in logs or error reports. 5. **Harden local output handling** - Canonicalize and validate every generated path against the selected output directory. - Continue sanitizing file names and reject paths that escape the export root. - Use securely created temporary files with restrictive permissions if intermediate storage is necessary. 6. **Reduce retention** - Avoid storing document bodies in conversation history or diagnostic telemetry. - Clear temporary content promptly after writing. - Document the retention and privacy behavior of the MCP and model environment. ]]>