T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:28
- Finding
- Plaintext Contact Exports Recommended for Version Control or Shared Storage<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28`; `scripts/xlsx_to_contacts.py:59-64, 82-85`; `references/contact-workflow.md:31-37` **Vulnerability Type**: Sensitive data exposure through insecure storage guidance **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md:28`: ```markdown 3. Keep payloads (campaign JSON, analytics snapshots, contact exports) in version control or shared storage per your security rules. ``` From `scripts/xlsx_to_contacts.py:59-64, 82-85`: ```python contacts.append( { "name": name, "phone": phone, "extraParams": {"context": context}, } ) contacts = sheet_to_contacts(Path(args.xlsx)) with open(args.output, "w", encoding="utf-8") as fh: json.dump(contacts, fh, indent=2) fh.write("\n") ``` The documented output format in `references/contact-workflow.md:31-37` confirms that the generated files contain personal data: ```json [ {"name": "Abhinav", "phone": "918179259307", "extraParams": {"context": "PGAGI"}}, {"name": "Bibin", "phone": "918179259307", "extraParams": {"context": "PGAGI"}} ] ``` ### Technical Analysis The contact conversion workflow writes names, international telephone numbers, and free-form contextual information to an unencrypted JSON file. The output file is created using the process's default permissions, which depend on the current umask and may permit access by unintended local users. More importantly, the Skill documentation recommends retaining contact exports, campaign payloads, and analytics snapshots in version control or shared storage. Version-control systems preserve historical objects even after a file is deleted from the working tree. Shared storage can similarly expose data through overly broad access-control lists, synchronization clients, backups, or public-link configuration. The network transfer of these contact records to the fixed HTTPS Toingg API is necessary for the declared upload and messaging workflow. The unneces ...[truncated 1498 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to store contact exports or raw analytics in version control. 2. Explicitly prohibit committing files containing names, phone numbers, message context, call records, or raw API responses. 3. Add generated contact, payload, response, and analytics paths to `.gitignore`. 4. Create sensitive output files with owner-only permissions, such as mode `0600`, rather than relying on the ambient umask. 5. Store required exports in encrypted, access-controlled storage with least-privilege ACLs. 6. Minimize exported fields and omit free-form context unless it is required for the requested campaign. 7. Define retention periods and securely delete temporary exports after successful upload. 8. Redact sensitive fields before logging or sharing API responses. 9. Replace realistic phone-number examples with clearly fictional reserved values. 10. Add an explicit confirmation step before retaining or sharing any generated data. ]]>