T09 · Insecure Skill Coding Practices
- Location
SKILL.md:38- Finding
Uncontrolled Disclosure of User Queries to a Third-Party Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:38-43
Related Configuration:meta.json:15
Vulnerability Type: External transmission of potentially sensitive user input without consent or redaction
Risk Level: MediumVulnerable Code Snippet
markdown **调用**（仅当 `citation_contract.live_retrieval_allowed == true`；用 `curl` 或宿主 HTTP 能力）： GET https://fojin.app/api/search/content?q=<URL编码查询>&size=5 # 全文检索 GET https://fojin.app/api/search/semantic?q=<URL编码查询>&top_k=5 # 语义检索The corresponding configuration enables this behavior:
json "live_retrieval_allowed": trueTechnical Analysis
The Skill directs the agent to URL-encode a search query and send it to the external
fojin.appservice whenever local sources are considered insufficient. Although the Skill validates retrieved source metadata and explicitly treats returned text as untrusted data, it does not apply equivalent safeguards to outbound data.Specifically, there is no requirement to:
- Obtain explicit user consent before contacting the third party.
- Reduce the user’s question to minimal, non-sensitive search terms.
- Detect or redact credentials, personal information, confidential text, or other secrets.
- Warn users that query strings may be retained in application, proxy, gateway, browser, or monitoring logs.
- Offer or enforce an offline-only mode for sensitive requests.
Because the query is transmitted in the URL of a GET request, it is also more likely to be captured by infrastructure logs than data sent in a request body. This is a data-disclosure flaw rather than remote code execution: the retrieved content is expressly treated as untrusted citation data and is not instructed to be executed.
Attack Path
- A user asks a doctrinal question containing private context, personal information, confidential material, or credential-like data.
- The agent determines that the bundled offline excerpts do not adequately cover the ...[truncated 1203 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user consent before performing live retrieval.
- Extract only the minimum doctrinal keywords needed for a search rather than transmitting the complete user question.
- Detect and remove personal information, authentication material, private document text, and other secrets before constructing a request.
- Abort remote retrieval when sensitive content cannot be safely separated from the search terms.
- Prefer a POST request body over a GET query string where the service supports it, while recognizing that POST alone does not replace consent or redaction.
- Document the external-service privacy boundary, including what is transmitted and the possibility of third-party logging.
- Provide an explicit offline-only mode and make it the default for requests containing sensitive context.
- Add outbound-query tests covering API keys, passwords, email addresses, identifiers, private notes, and confidential excerpts.
- Consider an allowlist that permits only normalized titles, source identifiers, section names, and non-sensitive doctrinal terminology in remote searches.