T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:324
- Finding
- Default Cloud Upload Can Disclose Sensitive Source Metadata Due to Incomplete Redaction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:324-384`, `SKILL.md:493-511`, and `SKILL.md:804-819` **Vulnerability Type**: Sensitive information disclosure through default-enabled cloud submission **Risk Level**: Medium ### Vulnerable Code `SKILL.md:324-359`: ```markdown ### 3.1 What Gets Sent The fingerprint manifest, behavior tags, and **redacted evidence artifacts** are uploaded. All evidence **must pass through the Local Redaction Pipeline before any network call is made**. ### 3.2 Local Redaction Pipeline Before uploading evidence to the cloud, the scanner runs every evidence record through the following mandatory redaction steps **in order**. No raw evidence leaves the local machine. **Step 1 — Credential Scrub** Replace all secret values with `[REDACTED]`. Only the **variable name** or **access pattern** is preserved. Regex for scrubbing: ``` (=|:|Bearer\s+|://[^@]+@)\s*["']?[A-Za-z0-9_\-\.]{8,}["']? → replace matched value portion with [REDACTED] ``` ``` `SKILL.md:376-384`: ```markdown **Step 3 — Content Truncate** The `context` field (matched code line) is limited to **a single line, max 200 characters**. No surrounding lines are collected. | Rule | Action | |------|--------| | Multi-line match | Keep only the first line | | Line > 200 chars | Truncate at 200, append `…[TRUNCATED]` | | Binary content detected | Replace entire context with `[BINARY DATA]` | ``` `SKILL.md:493-511`: ```markdown Each evidence record has the following structure: | Sub-field | Description | |-----------|-------------| | `tag` | The behavior tag that was triggered | | `value` | Redacted extracted value (URL / command / path), post Local Redaction Pipeline | | `file` | Source file path where the pattern was found | | `line` | Line number of the match | | `context` | Full content of the matched line (single line only, no surrounding context) | ``` `SKILL.md:804-819`: ```markdown Cloud intelligence is **enabled by default**. The user can explic ...[truncated 4934 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Make cloud submission opt-in** - Default `YIDUN_SKILL_SEC_CLOUD` to `false`. - Before the first upload, clearly identify the destination and data categories. - Require explicit user consent for each scan or a clearly recorded persistent preference. 2. **Avoid transmitting source lines by default** - Send behavior tags, counts, hashes, and coarse structural features instead of raw `context`. - If source context is necessary, require separate consent and display the exact proposed payload first. - Prefer locally generated feature vectors or normalized syntax tokens that cannot reconstruct source text. 3. **Use allowlist-based payload construction** - Define a strict schema containing only fields required by the threat-intelligence service. - Reject unknown fields rather than forwarding them. - Replace local paths and file names with per-scan opaque identifiers. - Remove URL query strings, fragments, user information, and sensitive path components. 4. **Strengthen secret detection** - Use multiple language-aware and format-aware detectors rather than one regular expression. - Detect common token formats, authorization schemes, connection strings, private-key blocks, query credentials, and high-entropy values. - Treat uncertain high-entropy or identifier-like values as sensitive. - Apply redaction repeatedly until no detector produces a match. 5. **Fail closed** - If redaction cannot be completed or validated, skip the cloud request and continue in local-only mode. - Never upload raw evidence as an error fallback. - Report that remote analysis was skipped because the payload could not be safely sanitized. 6. **Add a payload review mechanism** - Support local logging without secrets and present the final serialized request before transmission. - Show the destination, fields, item count, and byte size. - Permit users to remove individual evidence items or cancel the ...[truncated 721 chars]