T09 · Insecure Skill Coding Practices
Error
- Location
- skills/smyx_common/scripts/util.py:282
- Finding
- Credential and User Identifier Repurposed for Remote Account Registration<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:282-297, 312-338`; related instructions in `SKILL.md:59-70` **Vulnerability Type**: Sensitive information disclosure, identity confusion, and registration without explicit consent **Risk Level**: High ### Code Snippet ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") except Exception as _e: CommonUtil.trace_exception_stack(_e) return {} ``` ```python current__user_name = ( ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID ) found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") ``` ```python if current__user_name: data.setdefault('pnaUserName', current__user_name) ``` ### Technical Analysis The Skill instructions direct the Agent to use a configured API key as an `open-id`. The common request layer then selects `API_SECRET_KEY` before the usernam ...[truncated 1953 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `ApiEnum.API_SECRET_KEY` from all user-identity selection logic. 2. Define separate, strongly typed configuration fields for authentication credentials and user identifiers. 3. Never send an API key or secret as `openId`, `mobile`, `username`, or `pnaUserName`. 4. Disable automatic registration by default. 5. Require explicit, informed user consent before creating a remote account. 6. Use a dedicated pseudonymous identifier when report persistence is required. 7. Validate identity inputs and reject values that match credential formats. 8. Clearly document all recipients, purposes, retention periods, and deletion procedures for biometric and health data. 9. Add tests proving that secrets cannot reach identity fields or registration endpoints. ]]>