other
Warning
- Location
scripts/run.py:14- Finding
External Disclosure of Rehabilitation and Patient Task Data
- Content
View full analysis
str: payload = {"model": MODEL, "temperature": 0.0, "messages": [ {"role": "system", "content": system_prompt}, {"role": "user", "content": user_prompt}]} try: req = Request(API_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={"Content-Type": "application/json", "Authorization": f"Bearer {appkey}"}) resp = urlopen(req, timeout=120) return json.loads(resp.read().decode("utf-8"))["choices"][0]["message"]["content"] ``` ```python user_prompt = f"""Please generate reminders for the following rehabilitation tasks: Date: {today_str} Plan ID: {plan_id} Completed tasks: {json.dumps(completed, ensure_ascii=False)} Pending tasks: {json.dumps(pending, ensure_ascii=False)} Completion progress: {len(completed)}/{len(today_tasks)} Please convert the tasks into time-segmented reminders, mark each task's status, and provide encouragement.""" text = _call_llm(SYSTEM_PROMPT, user_prompt, appkey) ``` The final snippet is an English rendering of the source prompt text; its interpolated variables and data flow are unchanged. ### Technical Analysis The skill embeds the rehabilitation plan identifier and complete task records, including completion status and potentially user-supplied medical details, into an LLM prompt. It then sends the prompt to the fixed external endpoint `https://maas-api.hivoice.cn/v1/chat/completions`. The documented purpose discloses that a remote medical model is used, so this is not covert exfiltration. However, the implementation has no technical ...[truncated 1939 chars]- Remediation
View remediation