T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:172
- Finding
- Sensitive Agent Memory May Be Persisted Through Insufficiently Protected Backups## Vulnerability Details **File Location**: `SKILL.md`, lines 172–195 and 723–725 **Vulnerability Type**: Insecure storage and backup of sensitive agent metadata **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Long-term Memory** (`MEMORY.md`): ```markdown # MEMORY.md — Long-Term Memory ## About the Human - [Key preferences, communication style, timezone] ## Domain Knowledge - [Accumulated expertise, patterns noticed] ## Relationship Map - [Key people, their roles, preferences] ## Active Projects ### [Project Name] - Status: [state] - Key decisions: [what and why] - Next milestone: [date + deliverable] ## Lessons Learned - [Mistakes to avoid, patterns that work] ## Operational Notes - [Infrastructure details, credentials locations, tool quirks] ``` ``` ```markdown **Backup Strategy:** - Git-commit workspace files weekly (automated) - Export MEMORY.md to secondary storage monthly - Document all cron jobs in a recovery file ``` ### Technical Analysis The skill instructs agents to store potentially sensitive information in `MEMORY.md`, including personal preferences, relationship information, active-project details, infrastructure metadata, and credential locations. It then recommends automated weekly Git commits of workspace files and monthly export of `MEMORY.md` to unspecified secondary storage. The backup instructions do not require: - A private repository or restricted branch permissions - Encryption at rest or in transit - An allowlisted backup destination - Secret and sensitive-data scanning before backup - Redaction or data minimization - Explicit user approval before external export - Backup retention and secure-deletion controls - Exclusion of `MEMORY.md`, `USER.md`, or similar sensitive files from Git history Although `SKILL.md:492` separately prohibits writing credential values to files, credential locations, infrastructure details, personal data, and project metadata can still be operationally sensitive. Git history also ...[truncated 1593 chars]
- Remediation
- ## Remediation Suggestions 1. Exclude sensitive workspace files from automated Git commits by default: ```gitignore MEMORY.md USER.md memory/ ACTIVE-CONTEXT.md *.env *secret* *credential* ``` 2. Commit only an explicit allowlist of non-sensitive configuration files rather than the entire workspace. 3. Require explicit operator approval before exporting agent memory to any external or secondary destination. 4. Restrict backups to approved private repositories or encrypted storage with: - Encryption in transit and at rest - Least-privilege access controls - Multi-factor authentication - Access logging and alerting - Key rotation and recovery procedures 5. Run secret and sensitive-data scanning before every commit or export. Block the operation if credentials, credential locations, personal data, infrastructure identifiers, or prohibited file types are detected. 6. Minimize stored data. Replace credential locations and detailed infrastructure notes with references to approved secret-management systems that reveal no sensitive path or identifier. 7. Define retention periods and secure-deletion procedures for Git repositories, backup objects, local clones, and exported memory snapshots. 8. Document a Git-history remediation process using repository-history rewriting and credential rotation for accidental disclosures. 9. Replace the current backup guidance with a secure-by-default policy, for example: ```markdown - Back up only explicitly allowlisted, non-sensitive workspace files. - Never commit MEMORY.md, USER.md, secrets, credential metadata, or private logs. - Encrypt approved backups and send them only to operator-approved destinations. - Require sensitive-data scanning and explicit approval before each export. ```