T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:145
- Finding
- Medical Reports Are Transmitted to an External LLM Without De-identification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:77-91`, `scripts/run.py:145-151`, and `scripts/run.py:31-37` **Vulnerability Type**: Sensitive health information disclosure caused by missing de-identification **Risk Level**: High ### Complete Code Snippet ```python def load_input(path: Path, encoding: str) -> str: suffix = path.suffix.lower() if suffix == ".json": with path.open(encoding=encoding) as f: data = json.load(f) if isinstance(data, str): return data if isinstance(data, dict): for key in ("text", "content", "record", "input", "report"): v = data.get(key) if isinstance(v, str) and v.strip(): return v return json.dumps(data, ensure_ascii=False, indent=2) raise ValueError("JSON input must be a string or an object containing a supported report field.") return path.read_text(encoding=encoding) ``` ```python def run_recheck_reminder(report_text: str, llm, output_path: str = "") -> int: prompt = f"""Please generate a re-examination reminder list based on the following medical examination report. [Medical Examination Report] {report_text.strip()} Please strictly follow the required JSON and reminder output format.""" print("Generating re-examination reminder...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` The original source contains Chinese user-facing prompt text; the material security behavior shown above is a direct English rendering of that prompt. The executable data flow is unchanged: `report_text.strip()` is interpolated verbatim. ```python def _http_post(url: str, payload: Dict[str, Any], headers: Dict[str, str], *, timeout: int = 0) -> Any: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url=url, data=data, method="POST", headers={"Content-Type": "application/json", **headers}, ...[truncated 2482 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement de-identification before prompt construction: - Remove names, patient identifiers, telephone numbers, addresses, email addresses, exact birth dates, and other direct identifiers. - Replace necessary identifiers with per-request pseudonyms. - Detect common identifier formats using validated rules rather than relying only on free-form model instructions. 2. Apply data minimization: - Parse reports into an allowlisted structure containing only medically necessary findings. - Do not submit complete source documents when only abnormal findings are needed. - Reject or warn on inputs where de-identification cannot be performed reliably. 3. Add an explicit transmission notice and consent step describing: - The remote service receiving the data. - The categories of information transmitted. - Applicable retention, logging, and processing policies. 4. Add automated tests using reports containing representative identifiers and assert that those values are absent from serialized HTTP payloads. 5. Update `SKILL.md` so its privacy statement precisely matches implemented behavior. If the API retains or logs requests, disclose that behavior rather than claiming destruction solely on completion of the local invocation. 6. Avoid logging request bodies and ensure remote-side access controls, retention limits, and transport encryption are contractually and technically enforced. ]]>