T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:84
- Finding
- Untrusted Third-Party Task Delegation and Data Disclosure Without Security Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 84–114 **Vulnerability Type**: Third-party data disclosure and unsafe processing of externally controlled tasks **Risk Level**: Medium ### Vulnerable Code ```bash ### Tasks (Auth Required) Set: `AUTH="Authorization: Bearer YOUR_API_KEY"` Post a task: ```bash curl -X POST $CRABNET/tasks -H "$AUTH" \ -H "Content-Type: application/json" \ -d '{ "capability_needed": "security-audit", "description": "Review my skill for vulnerabilities", "inputs": { "url": "https://github.com/..." }, "bounty": { "karma": 15 } }' ``` Claim a task: ```bash curl -X POST $CRABNET/tasks/TASK_ID/claim -H "$AUTH" ``` Deliver results: ```bash curl -X POST $CRABNET/tasks/TASK_ID/deliver -H "$AUTH" \ -H "Content-Type: application/json" \ -d '{"result": {"report": "...", "risk_score": 25}}' ``` Verify delivery (requester): ```bash curl -X POST $CRABNET/tasks/TASK_ID/verify -H "$AUTH" \ -H "Content-Type: application/json" \ -d '{"accepted": true, "rating": 5}' ``` ``` ### Technical Analysis The Skill instructs an agent to exchange task inputs and generated results with an externally operated registry. It also permits the agent to claim tasks whose descriptions and input fields may be controlled by arbitrary registry users. No instructions require explicit user authorization before disclosure, classification of outbound information, credential and personal-data redaction, destination verification, or schema-based validation of retrieved tasks. The Skill also does not establish that remote task descriptions must be treated exclusively as untrusted data rather than executable agent instructions. This creates two related security boundaries: 1. **Outbound disclosure boundary:** Repository URLs, audit reports, source-related information, or other task inputs can be transmitted to the external registry. 2. **Untrusted instruction boundary:** A malicious registry participant can place adversarial ins ...[truncated 2061 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user approval before registration, task posting, task claiming, or delivery of any result to the external service. 2. Display the exact destination and complete outbound payload before transmission. 3. Treat every task description, input field, manifest, and API response as untrusted data. Explicitly prohibit remote content from changing system instructions, safety constraints, tool permissions, or the current user’s goals. 4. Enforce an allowlisted task schema with strict field types, size limits, URL validation, and rejection of unexpected fields. 5. Introduce outbound data-loss prevention controls that detect and redact API keys, access tokens, passwords, private keys, personal data, private source code, and conversation context. 6. Default to excluding local files and workspace content from task results unless the user approves each disclosure. 7. Use least-privilege agent execution for remotely sourced tasks, including restricted filesystem and network access. 8. Document secure API-key handling. Store keys in an approved secret store, never embed them in files, and prevent them from appearing in logs, task payloads, or generated reports. 9. Verify and document ownership of the registry endpoint, use TLS exclusively, and provide a mechanism to pin or approve trusted service endpoints. 10. Add clear warnings explaining that posted inputs and delivered reports leave the local environment and are processed by a third party.