T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:29
- Finding
- Unredacted Health and Identity Data Is Transmitted to an External LLM Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:29-35`, `scripts/run.py:170-180`, and `scripts/run.py:244-257` **Vulnerability Type**: Sensitive-data exposure caused by missing local de-identification **Risk Level**: High ### Vulnerable Code ```python def _http_post(url: str, payload: Dict[str, Any], headers: Dict[str, str], *, timeout: int = 0) -> Any: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url=url, data=data, method="POST", headers={"Content-Type": "application/json", **headers}, ) try: ctx = urllib.request.urlopen(req) if not timeout else urllib.request.urlopen(req, timeout=timeout) ``` ```python def run_health_record(health_info: str, llm, output_path: str = "") -> int: prompt = f"""Please extract a structured resident health record from the following resident health information. [Resident health information] {health_info.strip()} Return JSON and a summary according to the required format. Use null for information that was not provided and do not fabricate information.""" print("Extracting resident health record information...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` ```python try: health_info = load_input(input_path, args.encoding) except Exception as e: print(f"Failed to read input file: {e}", file=sys.stderr) return 1 llm = make_llm_caller(args.appkey, args.base, args.model, args.timeout) try: return run_health_record(health_info, llm, args.output) ``` ### Technical Analysis The application loads the complete contents of the supplied health-record file and embeds them directly into an LLM request. It does not locally detect, redact, tokenize, or reject direct identifiers such as names, government identification numbers, telephone numbers, or addresses. This conflicts with the privacy statements in `SKILL.md`, which state that direct identifiers are not processed and that strict de- ...[truncated 1384 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement local identifier detection and redaction before constructing the LLM request. 2. Cover common identifier classes, including names, identity numbers, telephone numbers, email addresses, addresses, insurance identifiers, and patient record numbers. 3. Replace identifiers with stable, non-reversible placeholders when correlation within one record is necessary. 4. Reject or require explicit confirmation for records that cannot be reliably de-identified. 5. Show the operator the redacted form that will be transmitted. 6. Add automated tests verifying that representative identifiers never reach the HTTP payload. 7. Update `SKILL.md` so its privacy claims accurately describe controls enforced by the implementation. 8. Establish retention, access-control, and data-processing requirements for the remote model service. ]]>