T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:389- Finding
Uncontrolled Secondary Disclosure of Connected-Account Data
- Content
View full analysis
tuple[str, str]` | Call an LLM for analysis, summarization, extraction. Max 200k chars input. Returns `(response, error)`. | | `proxy_execute` | `(method, endpoint, toolkit, query_params?, body?, headers?) -> tuple[any, str]` | Direct API call to a connected toolkit when no Composio tool exists. Returns `(response, error)`. | | `web_search` | `(query: str) -> tuple[str, str]` | Search the web via Exa AI. Returns `(results, error)`. | | `upload_local_file` | `(*file_paths) -> tuple[dict, str]` | Upload sandbox files to cloud storage. Returns `({"s3_url": ...}, error)`. | ``` ```markdown 5. Use `invoke_llm` for summarization and analysis — it gives better results than ad-hoc filtering. ``` ```markdown | Upload artifacts via upload_local_file ``` ### Technical Analysis The Skill can retrieve information from OAuth-connected services, including email, messaging, document, and collaboration platforms. It then exposes three broad secondary-processing mechanisms: 1. `invoke_llm` can transmit up to 200,000 characters to an external LLM. 2. `upload_local_file` can upload sandbox files to cloud storage. 3. `proxy_execute` can directly access connected-toolkit APIs when a curated Composio tool is unavailable. These mechanisms may be legitimate for bulk processing, but the Skill does not require data classification, content minimization, redaction, destination disclosure, retention controls, endpoint allowlisting, or explicit user authorization before secondary transmission. Encouraging the Agent to use `invoke_llm` for analysis increases the possibility that complete emails, documents, messages, or tool responses will be submitted where local processing would suffi ...[truncated 2482 chars]- Remediation
View remediation