T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:79- Finding
Excessive Disclosure of Shipment-Related Personal Information
- Content
View full analysis
• SĐT: • CMND/CCCD: • Thời gian nhận: ``` ```markdown ## Important Rules - **NEVER translate Vietnamese values** - status names, department names, everything stays in Vietnamese - Format currency with periods (e.g., 350.000đ) - Hide partial phone/ID info if present (masked with X or shown as is from API) - Show timestamps in readable format (YYYY-MM-DD HH:MM) - Display all meaningful data from the response ## Error Handling - If `data.bill_id` is 0: Tracking code not found - If `data.packages` is empty: No package details available - Always show the full response data even if some fields are empty ``` ### Technical Analysis The skill explicitly directs the agent to retrieve and display sender and recipient names, phone numbers, and the actual recipient's government identity value. Its masking requirement is ineffective because it permits values to be “shown as is from API.” The additional instructions to display all meaningful data and always show the full response further undermine data minimization and may expose sensitive fields not explicitly documented by the skill. A parcel-tracking response should normally disclose only information necessary to communicate shipment status. Full phone numbers, government identity values, and unrestricted API response data are not necessary for that purpose. T ...[truncated 1790 chars]- Remediation
View remediation