T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:143
- Finding
- Medical reports are transmitted without the documented de-identification## Vulnerability Details **File Location**: `SKILL.md:31-34`, `scripts/run.py:143-149` **Vulnerability Type**: Privacy control omission and transmission of sensitive medical information **Risk Level**: High The documentation states that identifiable information will be strictly de-identified before processing: ```markdown - **最小必要原则**：仅处理解读所必需的检查结果；不要求包含患者姓名等身份信息。 - **严格脱敏**：发送前对可识别身份信息进行脱敏处理。 - **不做本地持久化**：仅在内存中短暂处理；**本次调用结束即销毁**。 ``` However, the implementation inserts the complete report into an LLM request without applying redaction: ```python def run_lab_interpret(lab_report: str, llm, output_path: str = "") -> int: prompt = f"""请对以下检查报告进行辅助解读。 【检查报告】 {lab_report.strip()} 请严格按照要求输出 JSON + 摘要。""" print("正在解读检查报告...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` ### Technical Analysis `load_input` can accept arbitrary report text, including names, patient identifiers, contact details, demographics, and clinical history. `run_lab_interpret` then copies that input verbatim into the outbound model prompt. No function detects, removes, masks, or rejects identifying data. This behavior conflicts with the documented claim that identifiable information is strictly de-identified before transmission. Merely advising users not to provide identifying information is not equivalent to enforcing de-identification. ### Attack Path 1. A user supplies a laboratory report containing patient identifiers or other protected medical information. 2. `load_input` reads and returns the report without modification. 3. `run_lab_interpret` interpolates the complete report into `prompt`. 4. The `llm` closure passes the prompt to `_http_post`. 5. The report is transmitted to the configured remote model endpoint. 6. The remote service consequently receives both the clinical information and any identifiers present in the source report. ### Impact Assessment The remote endpoint can receive ...[truncated 490 chars]
- Remediation
- ## Remediation Suggestions 1. Add a local de-identification stage before constructing any network request. 2. Detect and redact common direct identifiers, including names, identification numbers, medical-record numbers, telephone numbers, addresses, email addresses, and account identifiers. 3. Reject or require explicit confirmation for reports that still appear to contain identifiable information. 4. Present the exact destination and categories of transmitted data before processing. 5. Minimize outbound data by extracting only clinically necessary measurements and context. 6. Add automated tests demonstrating that representative identifiers are removed before `_http_post` is called. 7. Update `SKILL.md` if de-identification cannot be reliably implemented; the documentation must accurately state that users are responsible for redaction. 8. Establish appropriate retention, access-control, and data-processing requirements for the receiving model service.