other
Error
- Location
- scripts/run.py:184
- Finding
- Medical records are transmitted without the promised de-identification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:184-201`, `scripts/run.py:218-244`, and `scripts/run.py:328-345` **Vulnerability Type**: Sensitive Medical Data Disclosure **Risk Level**: High ### Technical Analysis The documentation at `SKILL.md:42` states that personally identifiable information will be de-identified before any model or API request. The implementation does not perform such de-identification. Instead, the complete record is inserted directly into a prompt and transmitted to the configured LLM endpoint. Relevant code from `scripts/run.py:184-201`: ```python def build_prompt(payload: dict[str, Any]) -> tuple[str, str]: """构建 LLM 提示词，返回 (part1_prompt, part2_prompt).""" record = payload.get("record") or payload.get("text") or payload.get("content") or "" if not record.strip(): raise ValueError("输入缺少 record 字段") # 第一步：分块 - 将病历分为"患者的情况"和"医生的处理意见" chunk_prompt = """给定下面的病历文本，请抽取出两部分 1.患者的情况 2.医生的处理意见 输入： {} 输出： """.strip().format(record) return chunk_prompt, None ``` The derived medical content is subsequently transmitted two more times: ```python def run( payload: dict[str, Any], *, base: str, model: str, appkey: str, timeout: int ) -> str: """执行复诊病历生成.""" chunk_prompt, _ = build_prompt(payload) # 第一步：分块 chunk_result = call_llm(chunk_prompt, base=base, model=model, appkey=appkey, timeout=timeout) # 提取两部分内容 record1, record2 = extract_chunk_result(chunk_result) # 第二步：分别抽取 part1_prompt, part2_prompt = build_extract_prompts(record1, record2) part1_result = call_llm(part1_prompt, base=base, model=model, appkey=appkey, timeout=timeout) part2_result = call_llm(part2_prompt, base=base, model=model, appkey=appkey, timeout=timeout) ``` There is no redaction stage for names, government identifiers, telephone numbers, addresses, or other identifying information. Consequently, records containing personally identifiable health informat ...[truncated 1118 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Introduce a mandatory de-identification stage before constructing any prompt. 2. Detect and redact, tokenize, or pseudonymize names, identity numbers, telephone numbers, email addresses, detailed addresses, medical record identifiers, and other direct identifiers. 3. Reject transmission when identifiers cannot be handled with sufficient confidence, or require explicit informed authorization through the calling application. 4. Minimize the transmitted content to only the fields necessary for extraction. 5. Add automated tests proving that representative identifiers never appear in outgoing HTTP request bodies. 6. Consider local preprocessing or a locally hosted model for records that cannot be safely de-identified. 7. Document the actual processing behavior, residual re-identification risks, service operator, retention policy, and deletion guarantees. 8. Ensure that optional prepared-data and output files have restrictive permissions and an explicit retention policy. ]]>