T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:274
- Finding
- Plaintext Persistence of Sensitive Meeting and Relationship Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:274-299`, `SKILL.md:386-396`, and `SKILL.md:408` **Vulnerability Type**: Plaintext storage of sensitive personal and business information **Risk Level**: Medium ### Vulnerable Code `SKILL.md:274-299`: ```yaml Maintain a relationship file per key contact: name: "Jane Smith" company: "Acme Corp" role: "VP Engineering" first_met: "2026-01-15" meetings_count: 4 communication_style: "Data-driven, prefers email, gets straight to business" personal_notes: - Has twin daughters starting university this year - Marathon runner — ran Boston 2025 - Vegetarian (for restaurant picks) topics_of_interest: - Platform migration - Team scaling - AI/ML integration last_interaction: "2026-02-10" open_threads: - "Waiting on their security review" - "Interested in Phase 2 proposal" sentiment_trend: "positive — increasingly engaged" ``` The same section instructs the agent to retrieve these persistent records before meetings: ```markdown ### Before Each Meeting: Auto-Pull - Pull contact cards for all attendees - Surface open threads and last interaction - Flag if it's been >30 days since contact (relationship at risk) ``` `SKILL.md:386-396`: ```text meetings/ ├── briefs/ # Pre-meeting briefs │ └── YYYY-MM-DD-[title].md ├── notes/ # Meeting notes │ └── YYYY-MM-DD-[title].md ├── contacts/ # Relationship cards │ └── [name].yaml ├── actions/ # Action item tracker │ └── active-actions.json └── audit/ # Weekly meeting audits └── YYYY-WW-audit.md ``` `SKILL.md:408`: ```markdown - **Confidential meetings:** Mark notes as `CONFIDENTIAL` — don't include in weekly audit details. ``` ### Technical Analysis The Skill directs the agent to collect and persist sensitive information in ordinary Markdown, YAML, and JSON files. The stored information may include personal details, communication preferences, relationship history, meeting discussions, sent ...[truncated 2049 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Minimize collection** - Store only information necessary for the meeting workflow. - Do not retain family details, dietary preferences, inferred sentiment, or other sensitive personal facts by default. - Require explicit user confirmation before persisting personal or confidential information. 2. **Use protected storage** - Store sensitive records in an approved encrypted data store rather than ordinary Markdown, YAML, or JSON files. - Encrypt data at rest using keys managed outside the project directory. - Apply restrictive filesystem permissions if local files must be used. 3. **Enforce access boundaries** - Limit access to the user and agent components that require the records. - Prevent unrelated Skills and processes from reading the meeting-data directory. - Separate confidential meeting records from general workspace files. 4. **Implement lifecycle controls** - Define short, configurable retention periods. - Provide mechanisms to inspect, redact, export, and securely delete stored records. - Remove stale contact details and completed action records automatically. 5. **Protect repository and backup workflows** - Add sensitive storage paths to `.gitignore` and equivalent synchronization exclusions. - Warn users not to commit or share generated meeting records. - Ensure backups containing these records are encrypted and access-controlled. 6. **Replace semantic confidentiality labels with controls** - Treat `CONFIDENTIAL` as a policy trigger that prevents unnecessary persistence and sharing. - Require explicit authorization before confidential notes are stored, retrieved, summarized, or exported. ]]>