T09 · Insecure Skill Coding Practices
Error
- Location
- daemon/script_gen/llm_client.py:80
- Finding
- Undisclosed transmission of automation prompts and context to configurable external endpoints<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-31`, `daemon/script_gen/prompts.py:151-160`, `daemon/script_gen/llm_client.py:29-35`, `daemon/script_gen/llm_client.py:80-104` **Vulnerability Type**: Misleading network-egress claim and insufficient protection of externally transmitted data **Risk Level**: High ### Vulnerable Code The Skill documentation claims that all operations remain local: ```markdown Windows desktop daemon providing keyboard/mouse control, screenshots, window management, OCR, and UI Automation through a named pipe. All operations execute locally, with zero network egress. ``` The prompt builder includes the complete user prompt and every value supplied through the context object: ```python def build_user_prompt(prompt: str, context: dict = None) -> str: """Build a user prompt from the natural language description and optional context.""" lines = [f"Generate a desktop automation script for: {prompt}"] if context: lines.append("\nAdditional context:") for key, value in context.items(): lines.append(f" - {key}: {value}") lines.append("\nOutput ONLY valid JSON matching the schema above.") return "\n".join(lines) ``` The resulting content is sent to a configurable endpoint: ```python LLM_PROVIDER = os.environ.get("LLM_PROVIDER", "").strip().lower() LLM_BASE_URL = os.environ.get("LLM_BASE_URL", "").strip().rstrip("/") LLM_API_KEY = os.environ.get("LLM_API_KEY", "").strip() LLM_MODEL = os.environ.get("LLM_MODEL", "").strip() # Fallback: if only LLM_API_KEY is set, try OpenAI format _FALLBACK_URL = "https://api.openai.com/v1" _FALLBACK_MODEL = "gpt-4o-mini" ``` ```python def _chat_completion(system_prompt: str, user_prompt: str, temperature: float = 0.3, max_tokens: int = 4096) -> str: """Send a chat completion request to an OpenAI-compatible API. Returns the assistant's response text. Raises RuntimeError on failure. """ import ...[truncated 2849 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Correct `SKILL.md` and `README.md` to explicitly disclose optional external LLM communication, transmitted fields, destinations, and retention implications. 2. Require explicit opt-in before enabling network-backed generation. 3. Require per-request confirmation that shows the destination and a preview of the exact data being transmitted. 4. Enforce HTTPS for non-loopback endpoints and reject URLs containing embedded credentials. 5. Maintain an explicit provider allowlist or require administrator approval for custom endpoints. 6. Apply recursive, allowlist-based filtering to context data. Exclude credentials, clipboard contents, tokens, passwords, and raw screen text by default. 7. Disable automatic redirects or revalidate every redirect destination. 8. Separate local-model mode from remote-provider mode in both configuration and user-visible behavior. 9. Avoid returning remote response bodies in errors where they could introduce additional sensitive information into logs. ]]>