T09 · Insecure Skill Coding Practices
- Location
scripts/screen-activity.sh:12- Finding
Full-screen screenshots are transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/screen-activity.sh:12, 44-71;config.example.json:3;SKILL.md:76
Vulnerability Type: Plaintext transmission of sensitive screen contents
Risk Level: HighVulnerable Code
bash MLX_URL=$(python3 -c "import json; c=json.load(open('$CONFIG')); print(c.get('mlx_url','http://192.168.1.198:18000/v1'))" 2>/dev/null || echo "http://192.168.1.198:18000/v1")python import json, base64, urllib.request, sys with open('$SCREENSHOT', 'rb') as f: img_b64 = base64.b64encode(f.read()).decode() payload = { 'model': 'Qwen3.5-9B-MLX-4bit', 'messages': [{ 'role': 'user', 'content': [ {'type': 'image_url', 'image_url': {'url': f'data:image/png;base64,{img_b64}'}}, {'type': 'text', 'text': prompt} ] }], 'max_tokens': 80, 'temperature': 0.3 } try: req = urllib.request.Request( '$MLX_URL/chat/completions', data=json.dumps(payload).encode(), headers={'Content-Type': 'application/json', 'Authorization': 'Bearer placeholder'}, method='POST' ) resp = urllib.request.urlopen(req, timeout=60) data = json.loads(resp.read())The default configuration establishes the destination as:
json { "mlx_url": "http://192.168.1.198:18000/v1" }Technical Analysis
The script captures the entire screen, reads the resulting PNG file, Base64-encodes it, embeds it in a JSON data URI, and sends it to the configured vision-model endpoint. Base64 is an API serialization format and does not provide encryption, access control, anonymization, or confidentiality.
The default endpoint uses unencrypted HTTP. Consequently, any system capable of observing or modifying traffic between the workstation and the model server can recover the complete screenshot or alter the response. Screen captures can contain credentials, ...[truncated 1712 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit informed consent before enabling screenshot capture and remote transmission.
- Do not provide a non-loopback plaintext HTTP endpoint as the default.
- Require HTTPS with normal certificate and hostname verification for remote endpoints.
- If local plaintext service support is necessary, restrict it to explicitly approved loopback addresses and display a warning before use.
- Validate the endpoint scheme and destination before every request.
- Add application exclusions, sensitive-window filtering, pause controls, and configurable redaction.
- Consider extracting only the minimum necessary metadata locally instead of transmitting complete images.
- Clearly document who operates the model endpoint, what data is transmitted, retention behavior, and the security assumptions.
- Use a genuine authentication mechanism when required rather than the static
Bearer placeholderheader.