T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:21
- Finding
- Uncontrolled Cloud Inference Fallback Contradicts Local-Only Data Guarantee## Vulnerability Details **File Location**: `SKILL.md`, lines 21 and 38 **Vulnerability Type**: Privacy-sensitive data disclosure through an unspecified cloud inference fallback **Risk Level**: Medium **Relevant Code Snippet**: ```markdown - GDPR/HIPAA compliance via local inference (no data leaves server) ``` ```markdown - Maintain cloud API fallback for quality-critical tasks ``` ### Technical Analysis The Skill promises that local inference prevents data from leaving the server, but it also instructs operators to maintain a cloud API fallback for quality-critical tasks. Invoking such a fallback can transmit inference inputs—including prompts, client personas, business information, or regulated records—to an external service. The Skill does not specify an approved cloud provider, an explicit user-consent requirement, criteria for activating the fallback, sensitive-data classification or redaction, regulated-workload restrictions, retention controls, processing terms, or audit requirements. Consequently, the fallback may exceed the minimum network privileges necessary for a deployment represented as local-only. This is a configuration and workflow security weakness rather than evidence of an implemented exfiltration payload. The project contains only documentation, and no executable mechanism that automatically sends data was found. ### Attack Path 1. A client selects local inference based on the statement that no data leaves the server. 2. The deployed agent receives a prompt containing confidential, personal, or regulated information. 3. The request is classified as quality-critical, either manually or by downstream implementation logic. 4. The cloud API fallback is activated without a mandatory consent or sanitization gate. 5. The full request or associated context is transmitted to an unspecified external inference provider. 6. The external provider may process, log, or retain the information under controls ...[truncated 730 chars]
- Remediation
- ## Remediation Suggestions - Remove the cloud fallback from deployments advertised as local-only. - If fallback is required, make it explicitly opt-in per tenant and clearly state that selected data may leave the server. - Require separate, informed authorization before transmitting any request externally; do not infer consent merely from use of the Skill. - Define an allowlist of approved providers and endpoints rather than permitting an unspecified cloud API. - Prohibit cloud fallback for regulated or confidential workloads unless an appropriate processing agreement and compliance review are in place. - Apply data classification, minimization, and redaction before transmission. Exclude credentials, identifiers, health information, proprietary context, and unnecessary conversation history. - Enforce transport encryption, secure credential storage, least-privilege API keys, provider retention restrictions, and tenant isolation. - Record fallback activation, destination, reason, data classification, and authorization in privacy-preserving audit logs. - Provide a strict configuration mode that technically blocks all outbound inference traffic. - Replace the unconditional privacy statement with documentation accurately describing the processing boundary and every condition under which data may leave the server.