T09 · Insecure Skill Coding Practices
- Location
SKILL.md:388- Finding
Uncontrolled Disclosure of Candidate Data to an Unspecified Cloud OCR Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 388–395
Vulnerability Type: Uncontrolled external processing of sensitive candidate documents
Risk Level: MediumVulnerable Code Snippet
markdown ### 第一步：扫描候选人文件夹，识别5份必含材料 ### 第二步：读取材料内容 | 文件格式 | 解析方式 | |:---|:---| | .docx | python-docx库 | | .pdf | pdfplumber/pdftotext/PyMuPDF | | .jpg/.png等图片 | pytesseract OCR或云端OCR API |The quoted source text is preserved verbatim as evidence. It instructs the Agent to scan candidate materials and permits image processing through either local OCR or a cloud OCR API.
Technical Analysis
Candidate resumes, application forms, and interview records may contain personally identifiable information, contact details, education and employment history, salary information, interview evaluations, and other confidential recruitment data.
The workflow permits an unspecified cloud OCR API without defining:
- An approved provider or endpoint allowlist
- Explicit user consent before external transmission
- A local-only processing requirement or safe default
- Data minimization and redaction controls
- Encryption, retention, deletion, or provider-access requirements
- A restriction against using submitted data for service training
- Audit logging for external disclosures
As a result, an Agent following the Skill may select an external OCR provider and upload entire candidate images even when local OCR is available. The issue is a risky configuration and workflow design rather than evidence of intentionally malicious behavior.
Attack Path
- A user provides a candidate directory containing resumes, application forms, or interview records in image format.
- The Skill instructs the Agent to scan the directory and read the candidate materials.
- The Agent selects the permitted cloud OCR option instead of local
pytesseract. - Full document images are transmitted to an unspecified third-party service.
- The service processes and may retain, log, ...[truncated 903 chars]
- Remediation
View remediation
Remediation Suggestions
- Make local OCR with
pytesseractthe mandatory default for candidate documents. - Require explicit, informed user authorization before transmitting any document to an external OCR provider.
- Maintain an allowlist of approved providers and endpoints; prohibit arbitrary cloud OCR services.
- Display the provider name, destination, document scope, and data categories before requesting approval.
- Redact unnecessary identity, contact, salary, and other sensitive fields before upload.
- Require TLS transport, suitable data-processing terms, access controls, defined retention limits, deletion guarantees, and a prohibition on training with submitted data.
- Add a strict local-only mode that prevents all external transmission.
- Record auditable consent and disclosure events without logging document contents or sensitive extracted text.
- If external processing is not essential, remove the cloud OCR option entirely and report locally unprocessable files to the user.
- Make local OCR with