T09 · Insecure Skill Coding Practices
Error
- Location
- llm_integration.py:47
- Finding
- Optional Remote LLM Providers Transmit Source Code and Security Finding Data Contrary to Local-Only Privacy Claims## Vulnerability Details **File Location**: `llm_integration.py:47-49`, `llm_integration.py:79-94`, `llm_integration.py:140-154`, `llm_integration.py:207-229`, and `llm_integration.py:235-253` **Vulnerability Type**: Sensitive source-code and security-data disclosure to third-party LLM services **Risk Level**: High ### Vulnerable Code The vulnerability-analysis method incorporates source code and context into an LLM prompt: ```python prompt = self._build_vulnerability_analysis_prompt(code, vuln_type, context) response = self._call_llm(prompt) return self._parse_vulnerability_analysis(response) ``` The generated prompt includes the supplied source-code content: ```python return f"""You are a professional code security auditor. Analyze whether the following code contains a {vuln_type} vulnerability. ## Code Snippet ```python {code} ``` ## Context {context if context else "No additional context"} """ ``` Finding analysis similarly incorporates evidence and surrounding code: ```python return f"""Analyze whether the following security warning is a false positive. ## Finding - Type: {finding.get('type', 'unknown')} - File: {finding.get('location', {}).get('file', 'unknown')} - Line: {finding.get('location', {}).get('line', 0)} - Evidence: {finding.get('evidence', '')} ## Code Context {finding.get('context', 'No context')} """ ``` The Qwen provider sends the resulting prompt to Alibaba DashScope: ```python def _call_qwen(self, prompt: str) -> str: url = "https://dashscope.aliyuncs.com/api/v1/services/aigc/text-generation/generation" headers = { "Authorization": f"Bearer {self.config.api_key}", "Content-Type": "application/json" } payload = { "model": self.config.model, "input": { "messages": [ {"role": "user", "content": prompt} ] }, "parameters": { ...[truncated 3412 chars]
- Remediation
- ## Remediation Suggestions 1. Remove unconditional claims that all processing is local and that source code never leaves the environment. 2. Clearly identify Ollama as local and Qwen/ChatGLM as remote providers in `SKILL.md`, `README.md`, and `skill.yaml`. 3. Require explicit informed consent before enabling any remote provider. 4. Display the destination, categories of transmitted data, and applicable privacy implications before the first remote request. 5. Redact secrets before prompt construction, including API keys, passwords, bearer tokens, private keys, cloud credentials, and scanner evidence. 6. Minimize prompts to the smallest source fragment required for analysis. 7. Add an egress-disabled configuration that is enabled by default. 8. Enforce an allowlist of approved HTTPS destinations and reject arbitrary base URLs for remote operation. 9. Add tests proving that remote requests cannot occur without explicit opt-in and that sensitive evidence is removed before transmission. 10. Consider separating remote-provider support into an optional package so that a local-only installation has no external analysis path.