T09 · Insecure Skill Coding Practices
- Location
skill.py:200- Finding
Unconditional Transmission of Raw Non-URL User Messages to a Third-Party Service
- Content
View full analysis
Vulnerability Details
File Location:
skill.py:200-205,skill.py:143-145,utils.py:21-32
Vulnerability Type: Excessive transmission of potentially sensitive user input
Risk Level: HighVulnerable Code
skill.py:200-205:python # 1. Detect URL and convert it url = extract_url(message) if url: result = convert_link(url) else: # 2. Attempt share-code parsing first result = parse_share_content(message)skill.py:143-145:python result = _wrapped_call_api('/parse_share', { 'content': content })utils.py:21-32:python def call_api(endpoint: str, data: Dict[str, Any]) -> Optional[Dict[str, Any]]: """ Call the server API """ try: url = f"{API_BASE_URL}{API_PREFIX}{endpoint}" response = requests.post(url, json=data, timeout=API_TIMEOUT) response.raise_for_status() return response.json()The configured default destination is
https://op.squirrel2.cn, as defined inconfig.py:11.Technical Analysis
handle_message()treats every non-empty message that does not contain a URL as possible e-commerce share content. It passes the complete, unmodified message toparse_share_content(), which places it in thecontentfield of a POST request to the external service.The project already implements
is_token_format()inutils.py, which can locally determine whether text resembles a supported share code. However, the router does not use that function before transmitting the message. Thus, unrelated text, personally identifiable information, credentials, private conversation content, or other secrets can be disclosed even when local validation would show that the input is not a share code.This particularly exceeds minimum necessary access when the caller supplies a separate extracted product keyword: the Skill still sends the original raw message for share-code parsing before ...[truncated 1681 chars]
- Remediation
View remediation
Remediation Suggestions
- Invoke the existing
is_token_format()validator before calling/parse_share. Do not transmit raw content unless it matches a supported share-code format. - If the input is not a share code, send only a narrowly extracted product keyword to the search or comparison endpoint rather than the complete original message.
- Require explicit user confirmation before transmitting free-form pasted content that may contain sensitive information.
- Add input-length limits and reject unexpectedly large or unrelated payloads locally.
- Clearly disclose the destination, data fields transmitted, retention period, logging practices, and applicable privacy policy before network processing.
- Configure the server to minimize logs, redact sensitive fields, enforce short retention periods, and prohibit unrelated secondary processing.
- Add tests confirming that ordinary messages, credentials, personal data, and other non-token inputs are never sent to
/parse_share. - Keep HTTPS mandatory and reject non-HTTPS production API base URLs to preserve transport confidentiality.
- Invoke the existing