T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:29
- Finding
- Potential Disclosure of Sensitive User or Repository Information to External Research Services## Vulnerability Details **File Location**: `SKILL.md:29-33` (network-capable tools are also declared at `SKILL.md:10-17`) **Vulnerability Type**: External transmission without mandatory consent or sensitive-data filtering **Risk Level**: Medium ### Vulnerable Code ```markdown allowed-tools: - Read - Glob - Grep - Task - WebFetch(https://zkcompression.com/*) - WebFetch(https://github.com/Lightprotocol/*) - WebSearch - mcp__deepwiki__read_wiki_structure - mcp__deepwiki__read_wiki_contents - mcp__deepwiki__ask_question - mcp__zkcompression__SearchLightProtocol ``` ```markdown 2. **Gather context** - Match question to the [execution steps](#execution-steps) below - Use `Glob`, `Grep`, and `Read` to find relevant local files - Query DeepWiki MCP (`mcp__deepwiki__ask_question`) and `mcp__zkcompression__SearchLightProtocol` for repository-level context - Use `Task` subagents for parallel research across multiple repos when needed ``` ### Technical Analysis The workflow combines access to local repository files with external MCP, web-search, and subagent capabilities. It instructs the agent to submit the user's question to external research services but does not require: - User approval before transmission - Secret or personal-data detection - Redaction of proprietary source code, credentials, internal paths, or private identifiers - Minimization of the information included in an external query - A prohibition against copying local repository content into external requests - Disclosure of the third-party destination and its data-handling implications A user question can itself contain confidential information. Repository context gathered immediately before an external query may also be incorporated into that query when the agent attempts to obtain a more relevant answer. The Skill's later assertion that it does not transmit external secrets is descriptive rather ...[truncated 2106 chars]
- Remediation
- ## Remediation Suggestions 1. Add a mandatory sensitivity review before every external call. The agent must detect and remove credentials, private keys, tokens, personal data, internal URLs, and proprietary code. 2. Require explicit user approval before transmitting user-provided or locally read content to any third-party MCP, web, or subagent service. 3. Apply data minimization: submit only an abstracted technical question and never include full files, secrets, or unrelated repository context. 4. State explicitly that local file contents must not be copied into external requests unless the user identifies the exact content and affirmatively opts in. 5. Inform the user which external service will receive the query before submission. 6. Remove unrestricted `WebSearch` if it is unnecessary. Otherwise, restrict searches to documented, trusted domains. 7. Limit `Task` subagents to the same approved tools, repositories, domains, and privacy controls as the parent Skill. 8. Replace the unenforced claim that the Skill does not transmit secrets with enforceable workflow instructions, such as: ```markdown Before any external tool call: 1. Inspect the proposed request for secrets, personal data, private source code, internal paths, and authentication material. 2. Remove all sensitive and unnecessary content. 3. If local repository content or user-provided confidential material remains, show the exact proposed payload and obtain explicit user approval. 4. Never submit credentials, private keys, seed phrases, access tokens, or complete private files to an external service. ``` 9. Document the external providers, intended data recipients, and applicable retention or privacy considerations.