T09 · Insecure Skill Coding Practices
- Location
references/1-机构/接入指南/接入质量检查.md:203- Finding
Quality-assurance workflow requests payment logs and code screenshots without redaction requirements
- Content
View full analysis
Vulnerability Details
File Location:
references/1-机构/接入指南/接入质量检查.md, lines 203–211
Vulnerability Type: Sensitive information exposure through an insecure evidence-submission process
Risk Level: MediumVulnerable Content:
markdown ### Step 3: Reply to Technical Support by Email The institution organizes the check results and replies by email to the assigned technical support address (`WXP_GlobalTS@tencent.com`): - Subject: `[Institution launch check] <Institution ID> - <Institution name>` - The body must include: - The list of integrated products - The item-by-item check results for each module; it is recommended to attach a sample log or screenshot of a code fragment as evidence for each item - The primary contact person and contact detailsThe same file reinforces this practice at lines 225 and 421–431 by recommending sample logs or code fragments for individual checks and instructing the institution to email the completed report.
Technical Analysis
This is a payment-integration Skill that handles highly sensitive artifacts, including institution private keys, APIv3 keys, authorization signatures, merchant identifiers, payment order numbers, callback payloads, customer identifiers, and personal information. The quality-assurance workflow requests sample logs and code screenshots but does not require data minimization, sanitization, secret scanning, or redaction before transmission.
Logs and screenshots commonly capture complete request headers, environment-variable values, decrypted callback bodies, exception context, or nearby source-code configuration. Email also creates additional copies in sent folders, recipient mailboxes, backups, archives, and forwarded conversations.
The listed recipient is a Tencent-domain support address, so the behavior does not demonstrate malicious exfiltration. The vulnerability is the absence of safeguards around what operators ...[truncated 1579 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit sanitization gate before any evidence is transmitted.
- Prohibit submission of:
- Private keys, APIv3 keys, API keys, passwords, session cookies, and access tokens.
- Complete
Authorizationor signature headers. - Payment codes, bank details, identity-document data, phone numbers, and other personal information.
- Complete decrypted callback bodies or production database records.
- Require synthetic or test-environment data wherever possible.
- Limit evidence to the smallest excerpt needed to demonstrate the check result.
- Require automated secret scanning and a manual reviewer before submission.
- Replace ordinary email attachments with an approved encrypted support portal for evidence that cannot be sufficiently anonymized.
- Define access controls, retention periods, deletion procedures, and an incident-response process for accidentally disclosed secrets.
- Add a safe example showing masked values, such as truncated merchant IDs and
Authorization: [REDACTED]. - State that any accidentally disclosed credential must be revoked or rotated immediately.