T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:142
- Finding
- Patient Medical Data Is Transmitted Without Enforced De-identification## Vulnerability Details **File Location**: `scripts/run.py:142-149` **Related Documentation**: `SKILL.md:29-31` **Vulnerability Type**: Sensitive medical data disclosure caused by missing de-identification controls **Risk Level**: High **Category**: T09: Insecure Skill Coding Practices ### Vulnerable Code ```python def run_referral(case_summary: str, llm, output_path: str = "") -> int: prompt = f"""请根据以下患者病情摘要，给出转诊指导建议。 【患者病情】 {case_summary.strip()} 请严格按照要求输出 JSON + 摘要。""" print("正在评估患者转诊需求...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` The documentation states: ```markdown - **严格脱敏**：发送前对可识别身份信息进行脱敏处理。 - **不做本地持久化**：仅在内存中短暂处理；**本次调用结束即销毁**。 ``` ### Technical Analysis The implementation interpolates the entire contents of `case_summary` into the LLM prompt and submits it to the configured remote service. No code identifies, removes, masks, or validates direct and indirect patient identifiers before transmission. Because `load_input` accepts arbitrary text and JSON records, submitted content can include names, identification numbers, telephone numbers, addresses, medical record numbers, dates of birth, or other protected health information. The documented instruction that users should de-identify records is not a technical safeguard, and the stronger statement that strict de-identification occurs before sending is not enforced by the implementation. This creates a confidentiality weakness at the trust boundary between the local clinical environment and the external LLM endpoint. It is particularly consequential because the information is medical data and may be subject to contractual, regulatory, and organizational privacy requirements. ### Attack Path 1. An operator supplies a text or JSON input containing a patient case with identifying information. 2. `load_input` reads and returns that information without sanitization. 3. `run_referral` inserts the complet ...[truncated 1063 chars]
- Remediation
- ## Remediation Suggestions 1. Implement local de-identification before constructing the LLM prompt. At minimum, detect and mask common identifiers such as names, government identifiers, phone numbers, email addresses, postal addresses, medical record numbers, and exact dates not required for referral decisions. 2. Prefer structured input with an explicit allowlist of medically necessary fields instead of transmitting arbitrary records. 3. Reject records containing likely identifiers when safe automatic redaction cannot be guaranteed. Return a clear error requesting sanitized input. 4. Display the sanitized payload for operator confirmation before sending it when the workflow permits human review. 5. Add automated tests covering direct identifiers, indirect identifiers, nested JSON fields, and free-form clinical notes. 6. Ensure the remote provider's retention and logging controls are suitable for medical information and are reflected accurately in the documentation. 7. Revise `SKILL.md` so it does not claim strict de-identification unless that control is actually implemented and verified. 8. Document the external transmission boundary, the receiving service, retention behavior, and residual re-identification risks.