T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image_quality_detection_analysis.py:53- Finding
Shared fallback identity can expose cloud analysis records across users
- Content
View full analysis
Vulnerability Details
File Location:
scripts/image_quality_detection_analysis.py:53-58;skills/smyx_common/scripts/util.py:461-469, 617-625;skills/smyx_analysis/scripts/skill.py:143-156
Vulnerability Type: Shared fallback identity and insufficient per-user isolation
Risk Level: MediumComplete Code Snippets
scripts/image_quality_detection_analysis.py:53-58:python # 初始化内部用户身份；不要求用户输入，也不在帮助信息中展示。 OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) # 检查必需参数 if args.list: open_id = ConstantEnum.CURRENT__OPEN_IDskills/smyx_common/scripts/util.py:461-469:python if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_idskills/smyx_common/scripts/util.py:617-625:python ConstantEnum.DEFAULT__SKILL_PLATFORM_NAME and data.setdefault('skillPlatform', ConstantEnum.DEFAULT__SKILL_PLATFORM_NAME) if current__user_name: data.setdefault('pnaUserName', current__user_name) if bool(options.get("dataAsParams")) or bool(options.get("data_as_params")): params.update(data)skills/smyx_analysis/scripts/skill.py:143-156:python open_id = argss.pop('open_id', None) # if not open_id: ## ARK_CLAW ## # return "⚠️ 错误：缺少 open_id 参数" response = self.page(pageNum, pageSize, *args, **argss) if response: for item in response: if item.get("commonAiResponse") or item.get("healthAiResponse"): item["reportImageUrl"] = _get_analysis_export_url( ...[truncated 2474 chars]- Remediation
View remediation
Remediation Suggestions
- Require a verified, per-caller identity for cloud uploads and history queries. Reject these operations when no authenticated caller identity is available.
- Remove the workspace-wide fallback identity from multi-user execution paths. If fallback identities are needed for local demonstrations, restrict them to an explicit single-user mode that is disabled by default.
- Do not treat a caller-controlled username or
pnaUserNamevalue as authorization. Bind report ownership to the server-authenticated principal and tenant. - Reinstate and enforce the missing-identity check before uploads and report-list requests rather than leaving it commented out.
- Ensure the cloud API verifies that requested reports belong to the authenticated caller and tenant, independently of client-supplied request fields.
- Store per-user identity state in isolated storage keyed by a verified platform user identifier, with restrictive filesystem permissions.
- Add integration tests in which two distinct callers use the same Skill installation and verify that neither can list, retrieve, or generate links for the other caller’s reports.
- Existing deployments should identify records created under shared fallback identities and migrate, segregate, or revoke access to those records as appropriate.