T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:26
- Finding
- Sensitive Operational Data Is Transmitted to a Third-Party API Without Mandatory Minimization or Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–42, 74–90, 149–168, and 372–390 **Vulnerability Type**: Sensitive data exposure through outbound API requests **Risk Level**: Medium ### Vulnerable Code Snippets Lines 26–42 direct the Agent to send its reasoning or plan to an unauthenticated remote endpoint: ```markdown Check any reasoning for logical contradictions before acting on it. No API key required. ### When to use Call checkLogic when the agent is: - **Planning multi-step actions** — verify the plan is internally consistent before executing step 1 - **Combining information from multiple sources** — catch conflicting facts before they produce wrong decisions - **Working with numbers** — budgets, schedules, quantities, limits — where arithmetic contradictions hide in natural language ### How to use POST to `/v1/checkLogic` with the reasoning as a single string: ```bash curl -s -X POST https://api.icme.io/v1/checkLogic \ -H "Content-Type: application/json" \ -d '{"reasoning": "<the reasoning, plan, or statements to check>"}' ``` ``` Lines 74–90 direct the Agent to submit proposed actions to the service before every action: ```markdown Screen an action against your policy to see if it touches any policy variables. No credits charged. Use this to decide whether the action needs a full `checkIt` call. ### When to use Call checkRelevance before every action. It tells you whether the action is related to your policy at all. If it isn't, skip `checkIt` and proceed. If it is, run the full check. ### How to use POST to `/v1/checkRelevance` with your `policy_id` and the proposed action: ```bash curl -s -X POST https://api.icme.io/v1/checkRelevance \ -H "Content-Type: application/json" \ -H "X-API-Key: $ICME_API_KEY" \ -d "{ \"policy_id\": \"$ICME_POLICY_ID\", \"action\": \"<describe the action in plain English>\" }" ``` ``` Lines 149–168 request detailed action information, including potentially sensitiv ...[truncated 5945 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require informed user consent** - Before the first outbound policy check, clearly identify the destination, data categories, and purpose. - Require explicit confirmation before transmitting sensitive or user-provided content. - Allow users to disable remote checks or select local-only operation. 2. **Minimize request content** - Submit only normalized policy variables required for a verdict. - Prefer structured fields such as recipient domain, transaction amount, operation type, and sensitivity label instead of complete natural-language plans. - Do not send raw reasoning, message bodies, transcripts, source documents, or unrelated conversational context. 3. **Add mandatory redaction rules** - Strip API keys, passwords, access tokens, cookies, session identifiers, private keys, seed phrases, payment-card data, and authentication headers. - Redact unnecessary personal data, exact file contents, internal hostnames, and confidential identifiers. - Fail closed locally when safe redaction cannot be guaranteed. 4. **Classify data before transmission** - Add a local sensitivity check before invoking any remote endpoint. - Block transmission of secrets, regulated information, and data marked confidential unless the user explicitly authorizes a narrowly scoped disclosure. - Restrict `checkLogic` to sanitized assertions rather than complete internal reasoning. 5. **Reduce call scope** - Replace “call checkRelevance before every action” with checks only for consequential operations within configured policy categories. - Avoid remote requests for local reads, formatting, factual responses, and other non-consequential work. - Cache non-sensitive policy metadata locally where appropriate. 6. **Document remote data handling** - State retention periods, logging behavior, deletion procedures, storage regions, subprocessors, and whether submitted content is used for training. - Document ...[truncated 607 chars]