T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:446
- Finding
- Insecure Storage Recommendations for Sensitive Identity and Financial Documents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:446-449` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Content ```markdown **Folder 4: Emergency Copies** - Digital scans on phone - Email to yourself - Cloud storage backup ``` ### Technical Analysis The skill recommends copying visa-related documents to a phone, email account, and cloud storage without requiring encryption, multifactor authentication, access restrictions, secure transmission, retention limits, or deletion procedures. The surrounding document-organization guidance includes passports, previous visas, bank statements, employment letters, invitation letters, flight reservations, and hotel bookings. Consequently, users may interpret the quoted instructions as approval to retain unencrypted copies of highly sensitive identity, financial, employment, and travel records in commonly compromised storage locations. This is an insecure handling practice rather than an executable-code vulnerability. Exploitation requires unauthorized access to at least one storage destination, such as through account credential theft, an unlocked or compromised device, insecure cloud sharing, or email account takeover. ### Attack Path 1. A user follows the skill's advice and scans passport, visa, financial, or employment documents. 2. The user stores those files directly on a phone, sends them through ordinary email, or uploads them to a general cloud-storage account without additional encryption. 3. An attacker obtains access through phishing, credential reuse, session theft, malware, device loss, an incorrectly configured sharing link, or another account-compromise method. 4. The attacker searches the affected storage location and downloads the retained visa-application documents. 5. The exposed information is used for identity fraud, targeted phishing, account-recovery abuse, impersonation, travel-related social engineering, or financial fraud. ### ...[truncated 756 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Replace the existing storage advice with explicit secure-handling requirements: 1. Store sensitive scans only when operationally necessary. 2. Place files in an encrypted vault or encrypted archive rather than saving them directly in a photo gallery, downloads folder, mailbox, or ordinary cloud directory. 3. Protect devices and relevant accounts with strong unique passwords and multifactor authentication. 4. Enable full-device encryption and automatic screen locking. 5. Avoid sending passport, bank-statement, or visa scans through plaintext email. If transmission is necessary, use an approved encrypted channel or separately encrypted attachment, and communicate the decryption secret through a different channel. 6. Disable public-link sharing and verify cloud access permissions. 7. Retain only the minimum required documents and redact unnecessary financial or identity fields where accepted. 8. Remove local, email, cloud, trash-folder, and synchronization copies when they are no longer needed. 9. Include a warning that users must follow applicable privacy requirements and the secure-document instructions of the relevant embassy or visa center. A safer replacement would be: ```markdown **Folder 4: Encrypted Emergency Copies** - Keep only essential scans in an encrypted vault. - Enable device encryption, a strong screen lock, and multifactor authentication. - Do not email unencrypted passport or financial documents. - Restrict cloud access and disable public sharing links. - Securely delete copies when they are no longer required. ``` ]]>