T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_image.py:56
- Finding
- Undocumented Automatic Google Provider Can Transmit Local Images<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:56-69`, `scripts/generate_image.py:229-271`, and `scripts/generate_image.py:441-454` **Vulnerability Type**: Undisclosed third-party data transmission and unsafe provider auto-selection **Risk Level**: Medium ### Vulnerable Code ```python def detect_provider(): """Auto-detect provider based on available API keys.""" has_atlas = bool(os.environ.get("ATLASCLOUD_API_KEY")) has_gemini = bool(os.environ.get("GEMINI_API_KEY")) if has_atlas and has_gemini: print("Note: Both API keys found. Defaulting to Atlas Cloud. Use --provider google to switch.") return "atlas" if has_atlas: return "atlas" if has_gemini: return "google" print("Error: No API key found. Set ATLASCLOUD_API_KEY or GEMINI_API_KEY.", file=sys.stderr) print(" Atlas Cloud: https://www.atlascloud.ai", file=sys.stderr) print(" Google AI Studio: https://aistudio.google.com/apikey", file=sys.stderr) sys.exit(1) ``` ```python def gemini_generate(prompt, params, output_dir, image_path=None): get_gemini_key() print(f"Submitting image generation (Google AI Studio): {GEMINI_MODEL}") # Build content parts parts = [] if prompt: parts.append({"text": prompt}) # If editing with a local image file if image_path: if image_path.startswith(("http://", "https://")): print("Error: Google AI Studio requires local file for editing, not URL.", file=sys.stderr) print("Use --provider atlas for URL-based editing.", file=sys.stderr) sys.exit(1) if not os.path.exists(image_path): print(f"Error: File not found: {image_path}", file=sys.stderr) sys.exit(1) with open(image_path, "rb") as f: img_b64 = base64.b64encode(f.read()).decode("utf-8") ext = os.path.splitext(image_path)[1].lower() mime_map = {".png": "image/png", ".jpg": "imag ...[truncated 4033 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare Google AI Studio in `SKILL.md`, including: - `GEMINI_API_KEY` as an optional credential. - `generativelanguage.googleapis.com` as a network destination. - The fact that prompts and complete local images can be transmitted. - Relevant data retention, billing, and privacy implications. 2. Require explicit provider selection for Google: ```python if not args.provider: provider = "atlas" else: provider = args.provider ``` Do not select a provider solely because an unrelated credential happens to exist in the environment. 3. Before transmitting a local file, display the exact file path, size, and destination host, and require affirmative consent unless an explicit noninteractive consent option was supplied. 4. Keep provider credentials isolated. Read `GEMINI_API_KEY` only after the user explicitly selects the Google provider. 5. Add a file-size limit and validate the local file's actual format before loading it entirely into memory. 6. Avoid mutating the caller's `params` dictionary through `pop()`. Copy and validate supported parameters so provider-specific behavior remains predictable. ]]>