T09 · Insecure Skill Coding Practices
- Location
references/system-rca.md:45- Finding
Unredacted Diagnostic Payload Logging and Session Identifier Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
references/system-rca.md:45-52
Vulnerability Type: Sensitive data exposure through insecure diagnostic guidance
Risk Level: MediumVulnerable Code Snippet
markdown ### Step 3: Insert Probes BEFORE modifying any behavior, insert probes to collect evidence: | Probe Type | Location | What to Log | |-----------|----------|-------------| | Log | Each edge | `[EdgeN] from=X to=Y payload={...}` | | Return field | Tool result | `{ ..., debug: { sessionId, url } }` | | Metric | Critical path | Latency, success rate | | Assertion | Invariant points | `assert(sessionId != null)` |Technical Analysis
The system-level debugging procedure directs the agent to log payloads at every cross-layer edge and return
sessionIdandurlvalues in tool results. It does not require field allowlisting, sensitive-value redaction, development-only gating, access restrictions, retention limits, or removal of probes after diagnosis.Cross-layer payloads may contain authorization headers, cookies, API tokens, credentials, personal information, prompts, message contents, or confidential business records. Session identifiers may be authentication-adjacent secrets or provide useful correlation data. Internal URLs may disclose network topology, endpoint names, query parameters, or embedded credentials.
Although another reference recommends redacting sensitive logs generally, this specific mandatory diagnostic example presents unrestricted payload logging and explicit session disclosure without connecting those safeguards to the procedure. Full payload capture and client-visible session identifiers exceed the minimum information normally necessary for root-cause analysis.
Attack Path
- An attacker submits crafted content through an affected API, browser session, streaming connection, or tool invocation.
- A developer or agent follows the Skill's system-level RCA procedure and inserts the recommended probes.
...[truncated 1444 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace complete-payload logging with an explicit allowlist of non-sensitive diagnostic fields, such as event type, payload size, status, latency, and a generated correlation ID.
- Redact or omit authorization headers, cookies, session identifiers, API keys, passwords, private keys, personal information, message bodies, and URL query strings.
- Generate a random diagnostic correlation ID that is distinct from authentication and application session identifiers.
- Never return session identifiers to clients or include them in tool-visible debug fields.
- Sanitize URLs by removing user information, query parameters, fragments, and internal host details unless strictly required.
- Gate diagnostic probes behind a development-only or time-limited feature flag that is disabled by default in staging and production.
- Apply least-privilege access controls and short retention periods to diagnostic logs.
- Require probes to be removed or disabled immediately after evidence collection.
- Add automated tests verifying that sensitive field names and representative secret values do not appear in logs or tool responses.
- Revise the example to use a safe pattern such as:
markdown | Log | Each edge | `[EdgeN] from=X to=Y correlationId={id} eventType={type} payloadBytes={size}` | | Return field | Internal diagnostic result only | `{ debug: { correlationId, status } }` |