T09 · Insecure Skill Coding Practices
Warning
- Location
- helper.py:393
- Finding
- Default Plaintext Debug Logging Exposes User Content and Complete API Responses<![CDATA[ ## Vulnerability Details **File Location**: `helper.py:393-406`, `helper.py:445-451`, `helper.py:517-520`, `helper.py:540-556`, `helper.py:688-712` **Vulnerability Type**: Plaintext storage of sensitive data **Risk Level**: Medium ### Vulnerable Code `helper.py:393-406` records the complete payload and request body for every attempt: ```python def _capture_attempt(attempt_logs, payload, headers, text_mode, payload_mode, attempt_index): entry = { "attempt": attempt_index, "text_mode": text_mode, "payload_mode": payload_mode, "voice_id": ((payload.get("voice_setting") or {}).get("voice_id")), "request_format": "application/json", "headers": _redact_headers(headers), "text_length": len(payload["text"]), "text_preview": _preview_text(payload["text"]), "payload": payload, "request_body_json": _json_dumps(payload), } attempt_logs.append(entry) return entry ``` `helper.py:445-451` records the complete API response: ```python with urllib.request.urlopen(request) as response: response_body = response.read() response_text = _decode_response_body(response_body) attempt_entry["response_status"] = response.status attempt_entry["response_headers"] = dict(response.headers.items()) attempt_entry["response_text"] = response_text ``` `helper.py:517-520` writes debug data to disk as plaintext JSON: ```python def _write_debug_log(debug_log_path, payload): if not debug_log_path: return _write_json(debug_log_path, payload) ``` `helper.py:540-556` includes complete text variants and request attempts in failure logs: ```python def _write_failure_debug_log(debug_log_path, args, text_variants, attempt_logs): payload = { "api_url": API_URL, "text_file": str(Path(args.text_file).resolve()), "output": str(Path(args.output).resolve()), "voice_id": args.voice_id, "speed": args.speed, "pitch": ...[truncated 4065 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make debug logging explicitly opt-in. Do not derive and create a debug-log path unless `--debug-log` or a dedicated `--debug` flag is supplied. 2. Do not store complete request payloads, serialized bodies, text variants, metadata, or API response bodies in routine logs. 3. Record only minimal operational fields, such as attempt number, HTTP status, business status, text length, voice ID, and timing. 4. Explicitly remove `data.audio` before logging any API response. Avoid retaining even truncated audio payloads. 5. Redact or hash user text and metadata. If troubleshooting requires a preview, require explicit consent and impose a short, documented length limit. 6. Avoid recording absolute filesystem paths unless essential; use filenames or paths relative to the designated output directory. 7. Create opt-in debug files with restrictive permissions, such as mode `0600` on POSIX systems, and reject unsafe shared output locations where practical. 8. Define and document a retention policy, and provide an option to delete debug files automatically after successful processing. 9. Ensure failure reporting returns status codes and sanitized messages rather than complete remote response bodies. 10. Add tests verifying that normal synthesis creates only the requested audio output and that bearer tokens, source text, metadata, and audio hex are absent from logs. ]]>