T09 · Insecure Skill Coding Practices
- Location
SKILL.md:172- Finding
Sensitive Agent Memory May Be Persisted Through Insufficiently Protected Backups
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 172–195 and 723–725
Vulnerability Type: Insecure storage and backup of sensitive agent metadata
Risk Level: MediumVulnerable Code Snippet
markdown **Long-term Memory** (`MEMORY.md`): ```markdown # MEMORY.md — Long-Term Memory ## About the Human - [Key preferences, communication style, timezone] ## Domain Knowledge - [Accumulated expertise, patterns noticed] ## Relationship Map - [Key people, their roles, preferences] ## Active Projects ### [Project Name] - Status: [state] - Key decisions: [what and why] - Next milestone: [date + deliverable] ## Lessons Learned - [Mistakes to avoid, patterns that work] ## Operational Notes - [Infrastructure details, credentials locations, tool quirks]text ```markdown **Backup Strategy:** - Git-commit workspace files weekly (automated) - Export MEMORY.md to secondary storage monthly - Document all cron jobs in a recovery fileTechnical Analysis
The skill instructs agents to store potentially sensitive information in
MEMORY.md, including personal preferences, relationship information, active-project details, infrastructure metadata, and credential locations. It then recommends automated weekly Git commits of workspace files and monthly export ofMEMORY.mdto unspecified secondary storage.The backup instructions do not require:
- A private repository or restricted branch permissions
- Encryption at rest or in transit
- An allowlisted backup destination
- Secret and sensitive-data scanning before backup
- Redaction or data minimization
- Explicit user approval before external export
- Backup retention and secure-deletion controls
- Exclusion of
MEMORY.md,USER.md, or similar sensitive files from Git history
Although
SKILL.md:492separately prohibits writing credential values to files, credential locations, infrastructure details, personal data, and project metadata can still be operationally sensitive. Git history also ...[truncated 1593 chars]- Remediation
View remediation
Remediation Suggestions
-
Exclude sensitive workspace files from automated Git commits by default:
gitignore MEMORY.md USER.md memory/ ACTIVE-CONTEXT.md *.env *secret* *credential* -
Commit only an explicit allowlist of non-sensitive configuration files rather than the entire workspace.
-
Require explicit operator approval before exporting agent memory to any external or secondary destination.
-
Restrict backups to approved private repositories or encrypted storage with:
- Encryption in transit and at rest
- Least-privilege access controls
- Multi-factor authentication
- Access logging and alerting
- Key rotation and recovery procedures
-
Run secret and sensitive-data scanning before every commit or export. Block the operation if credentials, credential locations, personal data, infrastructure identifiers, or prohibited file types are detected.
-
Minimize stored data. Replace credential locations and detailed infrastructure notes with references to approved secret-management systems that reveal no sensitive path or identifier.
-
Define retention periods and secure-deletion procedures for Git repositories, backup objects, local clones, and exported memory snapshots.
-
Document a Git-history remediation process using repository-history rewriting and credential rotation for accidental disclosures.
-
Replace the current backup guidance with a secure-by-default policy, for example:
markdown - Back up only explicitly allowlisted, non-sensitive workspace files. - Never commit MEMORY.md, USER.md, secrets, credential metadata, or private logs. - Encrypt approved backups and send them only to operator-approved destinations. - Require sensitive-data scanning and explicit approval before each export.
-