other
Error
- Location
- hook/handler.ts:39
- Finding
- Automatic Disclosure of Incoming Messages to an External Scanning Service<![CDATA[ ## Vulnerability Details **File Location**: `hook/handler.ts:39-49` **Vulnerability Type**: Unrestricted transmission of potentially sensitive message content **Risk Level**: High ### Vulnerable Code ```ts async function scan(text: string): Promise<ShieldResult> { if (!API_KEY) throw new Error('PROMPTDOME_API_KEY is not set') const res = await fetch(API_URL, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${API_KEY}`, }, body: JSON.stringify({ text: text.slice(0, 50_000), mode: 'user_prompt', }), }) ``` The function is automatically invoked for every received message containing at least 12 non-whitespace characters: ```ts const content = event.context?.content if (!content || typeof content !== 'string' || content.trim().length < MIN_SCAN_LENGTH) return const trimmed = content.trim() try { const { score, level, recommendation, findings } = await scan(trimmed) ``` ### Technical Analysis The hook sends as many as 50,000 characters from every qualifying incoming message to the configured `PROMPTDOME_API_URL`. The default destination is the externally operated endpoint `https://promptdome.cyberforge.one/api/v1/shield`. Although remote scanning is part of the declared functionality, the implementation does not minimize the information disclosed. It has no local credential or PII redaction, destination allowlist, channel exclusion mechanism, per-message consent, or sensitivity classification. Incoming messages can contain passwords, API keys, personal information, confidential business data, or other secrets unrelated to prompt-injection detection. The destination can also be changed through `PROMPTDOME_API_URL`. If that environment variable is modified by a compromised configuration or untrusted administrator, all scanned messages can be redirected to another server. ### Attack Path 1. The user installs and enables the `promptdome-gate` hook. 2. An i ...[truncated 868 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make automatic remote scanning explicitly opt-in and disclose exactly what content is transmitted. - Provide a local-only scanning mode and prefer it by default. - Redact common credentials, authentication tokens, financial data, and PII before transmission. - Add channel, sender, and message-type exclusions so sensitive conversations can remain local. - Send only the minimum content necessary for classification rather than a blanket 50,000-character payload. - Enforce an administrator-configured HTTPS endpoint allowlist and reject insecure or unexpected destinations. - Add clear retention and data-processing documentation for the hosted API. - Consider requiring explicit user approval before transmitting content classified as potentially sensitive. ]]>