other
Warning
- Location
- scripts/run.py:14
- Finding
- External Disclosure of Rehabilitation and Patient Task Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py`, lines 14 and 24–31, with sensitive prompt construction at lines 76–88 **Vulnerability Type**: Sensitive Health Data Disclosure **Risk Level**: Medium ### Vulnerable Code ```python API_URL = "https://maas-api.hivoice.cn/v1/chat/completions" MODEL = "u2-med" ``` ```python def _call_llm(system_prompt: str, user_prompt: str, appkey: str) -> str: payload = {"model": MODEL, "temperature": 0.0, "messages": [ {"role": "system", "content": system_prompt}, {"role": "user", "content": user_prompt}]} try: req = Request(API_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={"Content-Type": "application/json", "Authorization": f"Bearer {appkey}"}) resp = urlopen(req, timeout=120) return json.loads(resp.read().decode("utf-8"))["choices"][0]["message"]["content"] ``` ```python user_prompt = f"""Please generate reminders for the following rehabilitation tasks: Date: {today_str} Plan ID: {plan_id} Completed tasks: {json.dumps(completed, ensure_ascii=False)} Pending tasks: {json.dumps(pending, ensure_ascii=False)} Completion progress: {len(completed)}/{len(today_tasks)} Please convert the tasks into time-segmented reminders, mark each task's status, and provide encouragement.""" text = _call_llm(SYSTEM_PROMPT, user_prompt, appkey) ``` The final snippet is an English rendering of the source prompt text; its interpolated variables and data flow are unchanged. ### Technical Analysis The skill embeds the rehabilitation plan identifier and complete task records, including completion status and potentially user-supplied medical details, into an LLM prompt. It then sends the prompt to the fixed external endpoint `https://maas-api.hivoice.cn/v1/chat/completions`. The documented purpose discloses that a remote medical model is used, so this is not covert exfiltration. However, the implementation has no technical ...[truncated 1939 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed consent before sending rehabilitation data to an external model. 2. Construct a strict allowlisted payload containing only fields necessary for reminder generation, such as a sanitized task label and completion state. 3. Remove or pseudonymize `plan_id` before transmission. 4. Recursively redact names, contact details, medical-record numbers, free-form clinical notes, and other identifiers. 5. Add an organization-controlled endpoint configuration with an allowlist rather than relying exclusively on a hardcoded third-party destination. 6. Provide a local-only mode for generating deterministic reminders without transmitting medical information. 7. Document the provider's retention, training, logging, deletion, and data-residency policies. 8. Add a preflight summary showing which fields and destination will be used, and require confirmation for sensitive inputs. 9. Enforce transport certificate validation and organizational egress controls; HTTPS alone does not address provider-side retention or authorization. 10. Add automated tests proving that unexpected task fields cannot enter the remote prompt. ]]>