T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/run.py:166
- Finding
- Sensitive medical data is transmitted without enforced de-identification## Vulnerability Details **File Location**: `scripts/run.py:166-185` **Vulnerability Type**: Unredacted transmission of sensitive health information **Risk Level**: Medium The skill documentation states that identifiable information must be de-identified before transmission, but the implementation does not enforce this requirement. ### Vulnerable Code ```python def run_vaccination_reminder(vaccination_info: str, llm, output_path: str = "") -> int: prompt = f"""请根据以下居民信息，生成预防接种提醒。 【居民信息】 {vaccination_info.strip()} 请严格按照要求输出 JSON + 摘要。""" print("正在生成预防接种提醒...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` The corresponding outbound request is implemented at `scripts/run.py:23-29`: ```python def _http_post(url: str, payload: Dict[str, Any], headers: Dict[str, str], *, timeout: int = 0) -> Any: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url=url, data=data, method="POST", headers={"Content-Type": "application/json", **headers}, ) ``` ### Technical Analysis The complete contents returned by `load_input()` are interpolated directly into the LLM prompt. No validation, data minimization, or redaction is performed before the prompt is serialized and transmitted to the configured external API. Vaccination records are health information and may also contain names, telephone numbers, identity numbers, addresses, or other direct identifiers. Although `SKILL.md:25-28` describes a strict de-identification policy, the code relies entirely on users to sanitize input correctly. This creates a privacy control gap because the documented policy is not enforced at the data boundary. ### Attack Path 1. A user or upstream system creates an input file containing vaccination history and direct identifiers. 2. The file is supplied through the `--input` argument. 3. `load_input()` returns the content without insp ...[truncated 923 chars]
- Remediation
- ## Remediation Suggestions 1. Add a mandatory de-identification stage before constructing the LLM prompt. 2. Detect and remove or tokenize names, identity numbers, telephone numbers, email addresses, precise addresses, medical record numbers, and other direct identifiers. 3. Reject input when sensitive identifiers are detected but cannot be redacted safely. 4. Send only the minimum fields required for vaccination scheduling, such as age range, vaccine history, and clinically relevant conditions. 5. Display the redacted payload for confirmation when the tool is used interactively. 6. Clearly document the API destination, data retention policy, and responsibility for obtaining consent. 7. Add automated tests proving that representative identifiers never appear in serialized outbound request bodies. 8. Avoid including raw request payloads in application, proxy, or API-provider logs.