T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
Unconfirmed Third-Party Disclosure of Complete Document Contents
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15-53
Vulnerability Type: External transmission of potentially sensitive document data without an explicit consent requirement
Risk Level: MediumThe Skill makes API mode the default and provides code that reads an entire document, Base64-encodes it, and sends it to the Upstage API:
python ## Two Modes | Mode | When to use | Latency | |------|-------------|---------| | **API mode** | Default. Fast schema generation via Upstage endpoint. | Low | | **VLM mode** (`claude-opus-4-6`) | When the user wants careful, hand-tuned schemas with precise extraction rules and table-aware design. | High | ## API Mode (Default) **Endpoint**: `POST https://api.upstage.ai/v1/information-extraction/schema-generation` ```python import os import json import requests import base64 api_key = os.environ["UPSTAGE_API_KEY"] with open("document.pdf", "rb") as f: b64 = base64.b64encode(f.read()).decode() response = requests.post( "https://api.upstage.ai/v1/information-extraction/schema-generation", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json={ "model": "information-extract", "messages": [ {"role": "system", "content": "Generate schema for this invoice document."}, {"role": "user", "content": [ {"type": "image_url", "image_url": {"url": f"data:application/pdf;base64,{b64}"}} ]} ] } ) schema = json.loads(response.json()["choices"][0]["message"]["content"]) print(json.dumps(schema, indent=2))text ### Technical Analysis The implementation reads every byte of the selected document and places the resulting Base64 data in an outbound HTTPS request. Base64 is transport encoding, not encryption or redaction; the receiving service can reconstruct the complete original document. Transmission to ` ...[truncated 2265 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before transmitting any source document to an external API. State the destination, the exact data being sent, and that Base64 does not protect document confidentiality.
- Offer local or VLM processing as the preferred option for confidential documents rather than making external API processing unconditional by default.
- Apply data minimization by sending only representative pages or document regions needed for schema design.
- Add optional redaction for identifiers, account numbers, signatures, addresses, and other sensitive fields before transmission.
- Validate allowed file types and enforce reasonable file-size and page-count limits.
- Document the external provider's retention, logging, training, residency, and deletion policies so users can make an informed decision.
- Avoid logging request bodies, Base64 payloads, authorization headers, or document contents.
- Keep the API key in environment-backed secret storage, scope it to the minimum required API operations, and ensure it is never included in generated output or diagnostic messages.