T09 · Insecure Skill Coding Practices
- Location
SKILL.md:49- Finding
Unconsented Disclosure of User Queries to an External Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 49–53
Vulnerability Type: External disclosure of potentially sensitive user data
Risk Level: MediumVulnerable Code
markdown **调用**（仅当 `citation_contract.live_retrieval_allowed == true`；用 `curl` 或宿主 HTTP 能力）： GET https://fojin.app/api/search/content?q=<URL编码查询>&size=5 GET https://fojin.app/api/search/semantic?q=<URL编码查询>&top_k=5Technical Analysis
The Skill instructs the Agent to send a URL-encoded search query to the third-party service
fojin.appwhen local excerpts are insufficient. It does not require informed user consent, provide notice that the query will leave the local environment, or require minimization and redaction of personal information.URL encoding is not anonymization or encryption. The query remains available to the external service and may also be recorded in HTTP client history, proxy logs, server access logs, monitoring systems, or analytics platforms because it is placed in a GET query string.
The remote-response safeguards elsewhere in
SKILL.md—including treating results as untrusted data and validating source identifiers—reduce prompt-injection and citation-integrity risks. They do not protect the outgoing user data.Attack Path
- A user asks a question containing sensitive context, such as religious affiliation, mental-health concerns, names, or personal experiences.
- The requested information is not sufficiently covered by the bundled sources.
- The Skill's live-retrieval condition activates.
- The Agent derives or forwards the sensitive content as the URL-encoded
qparameter. - The request is sent to
fojin.app. - The query may be observed or retained by the service and intermediary logging infrastructure without the user's informed consent.
Impact Assessment
This issue does not grant local code-execution privileges, elevated system permissions, or filesyst ...[truncated 428 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user consent before any live retrieval and identify the external destination.
- Explain what information will be transmitted and provide a strictly offline alternative.
- Construct a minimal source-search phrase rather than forwarding the original user message.
- Remove names, contact details, account identifiers, health information, secrets, and unrelated personal context before transmission.
- Prefer an HTTP POST body instead of a GET query string where the service supports it, while recognizing that POST alone does not eliminate third-party disclosure.
- Establish request timeouts, destination allowlisting, TLS certificate verification, and restrictive redirect handling.
- Document the external service's privacy, retention, and logging expectations.
- Add a policy check that blocks transmission when safe minimization cannot be performed.