T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:136- Finding
External Upload of User Media and Prompts Without Adequate Trust-Boundary Disclosure
- Content
View full analysis
}" FILE_PATH="$1"; TIPS="$2"; USER_PROMPT="${3:-}"; ASPECT_RATIO="${4:-9:16}"; DURATION="${5:-}" # -- Step 1: Upload -- echo "[1/4] Uploading $FILE_PATH..." >&2 UPLOAD_RESP=$(curl -sS -X POST "${SPARKI_API_BASE}/business/assets/upload" \ -H "X-API-Key: $SPARKI_API_KEY" -F "file=@${FILE_PATH}") ``` The workflow subsequently sends the user prompt and processing options to the same service: ```bash BODY=$(jq -n --argjson k "$KEYS_JSON" --argjson t "$TIPS_JSON" \ --arg p "$USER_PROMPT" --arg a "$ASPECT_RATIO" --arg d "$DURATION" \ '{object_keys:$k,tips:$t,aspect_ratio:$a} | if $p != "" then .+{user_prompt:$p} else . end | if $d != "" then .+{duration:($d|tonumber)} else . end') PROJ_RESP=$(curl -sS -X POST "${SPARKI_API_BASE}/business/projects" \ -H "X-API-Key: $SPARKI_API_KEY" -H "Content-Type: application/json" -d "$BODY") ``` ### Technical Analysis The primary Skill description emphasizes local transcription without an API key. However, the documented AI Edit workflow crosses an additional trust boundary by uploading the complete media file and associated prompt to `agent-api-test.aicoding.live`. The upload itself is documented and therefore is not covert exfiltration. Nevertheless, the documentation does not establish the relationship between the advertised `sparki.io` service and the separate test-domain endpoint, nor does it state retention, access, deletion, residency, or privacy policies. A user or agent may consequently treat a transcript-informed editing request as a normal extension of local processing without appreciating that privat ...[truncated 1489 chars]- Remediation
View remediation