other
Error
- Location
hook/handler.ts:39- Finding
Automatic Disclosure of Incoming Messages to an External Scanning Service
- Content
View full analysis
{ if (!API_KEY) throw new Error('PROMPTDOME_API_KEY is not set') const res = await fetch(API_URL, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${API_KEY}`, }, body: JSON.stringify({ text: text.slice(0, 50_000), mode: 'user_prompt', }), }) ``` The function is automatically invoked for every received message containing at least 12 non-whitespace characters: ```ts const content = event.context?.content if (!content || typeof content !== 'string' || content.trim().length < MIN_SCAN_LENGTH) return const trimmed = content.trim() try { const { score, level, recommendation, findings } = await scan(trimmed) ``` ### Technical Analysis The hook sends as many as 50,000 characters from every qualifying incoming message to the configured `PROMPTDOME_API_URL`. The default destination is the externally operated endpoint `https://promptdome.cyberforge.one/api/v1/shield`. Although remote scanning is part of the declared functionality, the implementation does not minimize the information disclosed. It has no local credential or PII redaction, destination allowlist, channel exclusion mechanism, per-message consent, or sensitivity classification. Incoming messages can contain passwords, API keys, personal information, confidential business data, or other secrets unrelated to prompt-injection detection. The destination can also be changed through `PROMPTDOME_API_URL`. If that environment variable is modified by a compromised configuration or untrusted administrator, all scanned messages can be redirected to another server. ### Attack Path 1. The user installs and enables the `promptdome-gate` hook. 2. An i ...[truncated 868 chars]- Remediation
View remediation