T09 · Insecure Skill Coding Practices
Error
- Location
- src/diagnosis.ts:45
- Finding
- Unredacted DLQ Content Disclosed to Bedrock and Telegram<![CDATA[ ## Vulnerability Details **File Locations**: - `src/metrics.ts:43-57` - `src/diagnosis.ts:45-54` - `src/diagnosis.ts:71-85` - `src/diagnosis.ts:95-99` - `src/reporter.ts:75-86` - `src/reporter.ts:98-102` - `src/reporter.ts:181-198` **Vulnerability Type**: Sensitive data exposure through external services **Risk Level**: High ### Vulnerable Code `src/metrics.ts:43-57`: ```typescript export async function peekDlqMessage( sqs: SQSClient, dlqUrl: string, ): Promise<string | null> { try { const resp = await sqs.send( new ReceiveMessageCommand({ QueueUrl: dlqUrl, MaxNumberOfMessages: 1, VisibilityTimeout: 10, WaitTimeSeconds: 1, }), ); const body = resp.Messages?.[0]?.Body; return body ? body.slice(0, 800) : null; } catch { return null; } } ``` `src/diagnosis.ts:45-54`: ```typescript const lines: string[] = [ `Detected issues: ${issues.join(" | ")}`, `AWS Region: ${region}`, `DLQ URL: ${dlqUrl}`, `Queue URL: ${queueUrl}`, ]; if (dlqSample) { lines.push(`DLQ message sample (1 msg): ${dlqSample}`); } ``` `src/diagnosis.ts:71-85`: ```typescript const body = JSON.stringify({ anthropic_version: "bedrock-2023-05-31", max_tokens: 400, system: SYSTEM_PROMPT, messages: [{ role: "user", content: lines.join("\n") }], }); try { const resp = await bedrockClient.send( new InvokeModelCommand({ modelId, contentType: "application/json", accept: "application/json", body: Buffer.from(body), }), ); ``` `src/diagnosis.ts:95-99`: ```typescript return { contexto: issues.join(". "), solucoes: dlqSample ? [`DLQ sample read: ${dlqSample.slice(0, 120)}…`] : [], ctas: [ ``` `src/reporter.ts:75-86`: ```typescript if (incident) { msg += `\n🔴 *Incident Detected*\n`; msg += `\n*Context*\n${esc(incident.contexto)}\n` ...[truncated 2988 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not retrieve or transmit raw DLQ bodies by default. Make payload inspection an explicit, opt-in configuration. 2. Parse messages locally and construct diagnosis input from an allowlist of non-sensitive fields such as error type, schema-validation path, event timestamp, and sanitized status code. 3. Recursively redact common sensitive fields, including passwords, API keys, authorization headers, cookies, access tokens, email addresses, phone numbers, and customer identifiers. 4. Apply pattern-based secret detection to unstructured content before invoking Bedrock. 5. Perform truncation only after redaction so that a secret at the beginning of a message cannot bypass protection. 6. Remove raw `dlqSample` content from the fallback incident. Report only that a sample was available and provide a safe operator workflow for inspecting it within AWS. 7. Add separate configuration controls for sharing sanitized diagnostics with Bedrock and Telegram. 8. Document the external data recipients, expected retention behavior, and data-classification requirements. 9. Add tests proving that sensitive fields and token-like strings never appear in Bedrock requests or Telegram report text. ]]>