T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:137
- Finding
- Medical reports are transmitted without the promised local de-identification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:137-143`; related privacy claim at `SKILL.md:27-29` **Vulnerability Type**: Sensitive data disclosure caused by missing de-identification **Risk Level**: High ### Vulnerable Code ```python def run_abnormal_items(report_text: str, llm, output_path: str = "") -> int: prompt = f"""请对以下体检报告中的异常指标进行专项深度解读。 【体检报告/异常指标信息】 {report_text.strip()} 请严格按照要求输出 JSON + 专项解读。""" print("正在进行异常指标专项解读...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` The corresponding documentation states: ```markdown - **最小必要原则**：仅处理指标解读所必需的检查数据；不要求包含直接身份标识。 - **严格脱敏**：发送前对可识别身份信息进行脱敏处理。 - **不做本地持久化**：仅在内存中短暂处理；**本次调用结束即销毁**。 ``` ### Technical Analysis The skill accepts complete medical reports and directly interpolates the unmodified `report_text` into the prompt sent to the external model API. No local routine identifies, removes, masks, or validates names, patient identifiers, addresses, telephone numbers, dates of birth, or other identifying fields. This behavior conflicts with the documented promise that identifiable information is strictly de-identified before transmission. Because the documented input format permits a complete examination report, the transmitted content may combine direct identifiers with sensitive medical findings. The disclosure is not limited to fields needed for interpretation: the entire loaded text is transmitted. The default destination is the external endpoint `https://maas-api.hivoice.cn/v1/chat/completions`. ### Attack Path 1. A user supplies a complete health examination report containing identifying and medical information through `--input`. 2. `load_input` reads the report without redacting sensitive fields. 3. `run_abnormal_items` inserts the complete report into `prompt`. 4. `llm(...)` passes that prompt to `_http_post`. 5. The external API receives the identifiable medical report despite the skill's de-identification claim. ### Impact Assessment T ...[truncated 528 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement deterministic local de-identification before constructing the prompt. At minimum, detect and mask names, patient and examination identifiers, telephone numbers, email addresses, street addresses, government identifiers, and exact dates of birth. 2. Prefer an allowlist-based parser that extracts only medically necessary fields instead of sending the complete input document. 3. Display a clear warning and require explicit confirmation if likely identifiers remain after redaction. 4. Provide users with a preview of the exact redacted content that will be transmitted. 5. Add automated tests containing representative identifiers and verify that none appear in outgoing request bodies. 6. Document the external data transfer, destination, retention assumptions, and limitations of automated redaction. 7. If reliable de-identification cannot be guaranteed, remove the strict de-identification claim and require callers to submit pre-redacted reports. ]]>