T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fts5_index.py:329
- Finding
- Private Memory Disclosure Through an Unrestricted LLM Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fts5_index.py:329-424`; default invocation paths in `scripts/session_search.py:128-166, 352-357` **Vulnerability Type**: Sensitive-data transmission to an unrestricted network destination **Risk Level**: High ### Vulnerable Code ```python # scripts/fts5_index.py LLM_API_URL = os.environ.get( "LLM_API_URL", "http://localhost:11434/api/generate" ) LLM_MODEL = os.environ.get("LLM_MODEL", "llama3") ``` ```python def summarize(self, results: List[Dict], query: str, max_context: int = 3000) -> str: """Use an LLM to summarize search results.""" if not results: return f"No memory related to {query} was found" context = self._build_context(results, max_context) prompt = f"""You are an assistant for a secretary-style memory system. Summarize information related to the user query: {query}. ## Search Results {context} """ summary = self._call_llm(prompt) return summary ``` The original prompt in the file is written in Chinese, but its interpolated sensitive fields are produced by the following code: ```python def _build_context(self, results: List[Dict], max_context: int) -> str: """Build LLM context.""" context_parts = [] total_len = 0 for i, r in enumerate(results, 1): part = f""" --- Result {i} --- File: {r['path']} Date: {r['date']} Partition: {r['partition']} Content: {r['content'][:1000]} """ part_len = len(part) if total_len + part_len > max_context: break context_parts.append(part) total_len += part_len return "\n".join(context_parts) ``` ```python def _call_llm(self, prompt: str) -> str: """Call the LLM API.""" import urllib.request import urllib.error if not self.api_url or self.api_url == "http://localhost:11434/api/generate": raise LLMSummarizationError( "LLM API is not configured or accessible.", hint="Set LLM_API_URL to your LLM ...[truncated 3310 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable LLM summarization by default and require an explicit option such as `--llm`. 2. Require informed confirmation before the first transmission to each endpoint. 3. Permit only explicitly configured HTTPS destinations on a trusted-host allowlist. 4. Reject HTTP, non-web schemes, embedded credentials, loopback rebinding targets, and cross-host redirects. 5. Remove absolute paths and unnecessary metadata before constructing the prompt. 6. Redact likely credentials, access tokens, private keys, email addresses, and other sensitive fields. 7. Display a preview of the exact information and destination before transmission. 8. Support a strictly local summarizer that cannot initiate network requests. 9. Add configurable partition exclusions so sensitive profile or relationship data is never sent remotely. 10. Document the data flow prominently rather than describing ordinary search as implicitly using an LLM. ]]>