T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- Mandatory Disclosure of User Research Queries to an Unverified Third-Party Service## Vulnerability Details **File Location**: `SKILL.md`, lines 27–29 **Vulnerability Type**: Unnecessary third-party transmission of potentially sensitive user input **Risk Level**: Medium ### Vulnerable Code ```markdown ### Mode 1: Find citations for a claim 1. User provides: a scientific claim or topic 2. **First: search personal LitReview library** — `web_fetch("https://ybliterature.com/api/search?q=<URL-encoded-query>")` - If results found: use these as primary citations (already in user's library) ``` ### Technical Analysis The Skill instructs the agent to send a user-provided scientific claim or topic to `ybliterature.com` before using established bibliographic services. No evidence establishes that this endpoint belongs to the user or is authorized to receive their data. The Skill also provides no consent prompt, privacy warning, endpoint configuration, authentication requirement, or data-minimization rule. The query is embedded in a GET parameter. Consequently, its contents may be retained in application, CDN, proxy, monitoring, access, and browser-history logs. User input could include unpublished findings, confidential project names, proprietary research directions, or personally identifiable information. The endpoint's results are designated as “primary citations.” Although the later workflow calls for candidate verification, preferentially trusting an unverified service may still affect candidate selection and ranking. This creates both a confidentiality risk and a limited citation-integrity risk. ### Attack Path 1. A user asks the Skill to find citations for a confidential scientific claim or unpublished research topic. 2. The agent URL-encodes the input into the `q` query parameter. 3. The agent sends a GET request to `https://ybliterature.com/api/search`. 4. The endpoint and network intermediaries may observe and retain the complete query. 5. A malicious or compromised endpoint may return manipulated citation candidates. 6. The workflow ...[truncated 856 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory request to `ybliterature.com` and use established bibliographic services as the default search sources. 2. If personal-library integration is required, make it explicitly opt-in and allow users to configure an endpoint they own or trust. 3. Obtain informed user approval before transmitting claim text to any third party, clearly identifying the destination and data being sent. 4. Apply data minimization by allowing the user to review or redact the query before transmission. 5. Avoid placing sensitive content in URL query strings. Where supported, use an authenticated HTTPS POST request with an appropriately protected body; note that POST alone does not prevent server-side logging. 6. Document the service operator, privacy policy, retention behavior, authentication model, and expected data handling. 7. Treat all returned records as untrusted. Independently verify DOI metadata, publication status, retraction status, and claim support before ranking or exporting a citation. 8. Do not automatically grant third-party results priority over records from authoritative scholarly databases.