T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:429- Finding
Authenticated Knowledge-Base Content Is Exposed to the Agent Context
- Content
View full analysis
{ for (let retry = 0; retry < 3; retry++) { try { const r = await fetch(`/api/docs/${slug}?book_id=${BOOK_ID}`, { credentials: 'include', headers: { 'Accept': 'application/json' } }); if (r.status === 429) { await new Promise(ok => setTimeout(ok, 2000 * (retry + 1))); continue; } const data = await r.json(); const content = data.data?.content || data.data?.body_lake || data.data?.body_html || ''; return { slug, title: titles[i], md: window._lakeToMarkdown(content, titles[i]), ok: true }; } catch (e) { if (retry === 2) return { slug, title: titles[i], md: `# ${titles[i]}\n\n(导出失败: ${e.message})\n`, ok: false }; await new Promise(ok => setTimeout(ok, 1000)); } } })); JSON.stringify(results); ``` The surrounding instructions require each result batch to be returned through `evaluate_script` to the agent before the agent writes it to local files. ### Technical Analysis The Skill legitimately needs authenticated read access to the selected Yuque knowledge base to perform an export. However, it uses the browser's authenticated session through `credentials: 'include'`, retrieves complete document bodies, converts them to Markdown, serializes the Markdown into JSON, and returns that JSON to the AI agent. Routing full document bodies through the agent context exceeds the minimum privilege required for a local export. Fetching, conversion, and file writing could instead occur within a trusted local process, while the agent receives only operational metadata such as ...[truncated 2770 chars]- Remediation
View remediation