T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:31
- Finding
- Unbounded Disclosure of Session Context to an External Model Provider<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-58` **Vulnerability Type**: Sensitive information exposure through third-party model delegation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## How to Delegate 1. Estimate output token length. 2. Check whether current session is enabled. 3. If enabled and estimate >= threshold, run `sessions_spawn` with Solar Pro3. Example spawn task pattern: ```text <context + writing instruction> 중요: 도구(tool)를 사용하지 말고 텍스트만 바로 출력해줘. 파일 읽기/쓰기 등 도구 호출 금지. ``` Set model to: - `openrouter/upstage/solar-pro-3` ### Main Session Use `sessions_spawn` and wait for auto-announced result. ### Messenger Sessions (Slack/Telegram/etc.) Use `sessions_spawn`, then fetch the final assistant text and forward it through the appropriate message channel/thread. If no final text arrives within a reasonable timeout, fall back to direct response. ## Rules - Pass through Solar output as-is (no extra summary/footer/metadata). - Keep non-user-facing orchestration text minimal. - Do not output intermediate narration between tool calls. - Always include the “no tool call” instruction in spawn tasks. ``` ### Technical Analysis The Skill intentionally delegates text generation to the external model `openrouter/upstage/solar-pro-3`. External network communication is necessary for the declared delegation feature, but the instruction to send `<context + writing instruction>` does not define or enforce a minimum-data boundary. There are no documented controls requiring the agent to: - Include only the text strictly necessary for the drafting task. - Exclude API keys, credentials, hidden prompts, tool results, persistent memory, or unrelated conversation history. - Detect or redact personal, confidential, or proprietary information. - Notify the user that content will be transmitted to OpenRouter and potentially a downstream model provider. - Obtain per-request consent for sensitive transfers. - Review or vali ...[truncated 2078 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Enforce strict context minimization** - Send only the exact user-provided text required for the drafting operation. - Do not include complete session transcripts by default. - Explicitly exclude system prompts, hidden instructions, persistent memory, unrelated history, tool results, environment data, and authentication material. 2. **Add sensitive-data detection and redaction** - Detect common API keys, access tokens, passwords, private keys, connection strings, and personal identifiers before delegation. - Block delegation when safe redaction is not possible. - Replace detected sensitive values with neutral placeholders rather than sending them externally. 3. **Require informed user authorization** - Clearly disclose that selected content will be transmitted to OpenRouter and its downstream model provider. - Obtain explicit consent before delegating sensitive or previously unseen content. - Provide a simple option to process the request directly without external delegation. 4. **Define session-specific data policies** - Disable delegation by default for confidential, administrative, or tool-intensive sessions. - Apply stricter rules to shared Slack or Telegram channels where messages may contain data belonging to multiple users. - Treat token thresholds solely as performance controls, not as privacy controls. 5. **Validate delegated output** - Remove the requirement to forward Solar output unconditionally “as-is.” - Review output for accidental secret reproduction, unsupported claims, unsafe content, and unintended disclosure before forwarding it. - Preserve the fallback to direct generation when validation fails. 6. **Protect provider credentials** - Store the OpenRouter key in the platform’s secret manager or protected environment configuration. - Never place a real key directly in version-controlled configuration. - Restrict access to configuration files and rot ...[truncated 314 chars]