T09 · Insecure Skill Coding Practices
Warning
- Location
- sub-skills/ipfs-storage.md:77
- Finding
- Permanent Plaintext Publication of Sensitive Financial Position Data to IPFS## Vulnerability Details **File Location**: `sub-skills/ipfs-storage.md:77-106` **Vulnerability Type**: Plaintext transmission and immutable publication of sensitive financial data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Store CDP position snapshot Store a snapshot of CDP positions on IPFS for auditing or record-keeping purposes. **Prompt:** "Store a snapshot of my CDP data on IPFS for my records" **Workflow:** 1. First gather CDP data using other tools (e.g., `get_cdps_by_owner`). 2. Format the data as a text snapshot. 3. Call `store_on_ipfs` with the formatted snapshot: ``` store_on_ipfs({ "text": "CDP Snapshot — 2025-01-15\n\nOwner: addr1q9x...\n\nCDP #1: iUSD\n Collateral: 5,000 ADA\n Minted: 1,200 iUSD\n Ratio: 312%\n\nCDP #2: iBTC\n Collateral: 15,000 ADA\n Minted: 0.08 iBTC\n Ratio: 280%" }) ``` 4. Return the CID as a permanent reference to this snapshot. **Sample response:** ``` CDP Snapshot Stored ─────────────────── CID: QmR4t8Y2nP7aK1wV9xB3dF5gH6jM0sQ8uL2cE4iO7pXn Your CDP position snapshot has been permanently stored. Use this CID to retrieve the snapshot at any time for auditing or comparison purposes. ``` ``` Supporting documentation in `references/mcp-tools.md:20-24` explicitly states that content is stored as plain text and that the returned CID is a permanent, immutable reference. ### Technical Analysis The documented workflow directs the Agent to gather a user's CDP information through another tool and submit the resulting snapshot to `store_on_ipfs`. The example payload includes a wallet owner address, collateral balances, minted assets, and collateralization ratios. IPFS content is content-addressed and distributed. The project documentation states that the data is stored as plain text and describes the CID as permanent and immutable. The workflow does not require encryption, identifier redaction, a sensitive-data rev ...[truncated 1877 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed confirmation immediately before publishing any wallet-linked or financial data. The confirmation should state that IPFS data may be publicly retrievable, replicated, and effectively irreversible. 2. Add a mandatory sensitive-data inspection step before `store_on_ipfs` is called. Reject private keys, seed phrases, API credentials, authentication tokens, personally identifying information, and other secrets. 3. Redact wallet addresses and unnecessary position identifiers by default. Include only the minimum fields required for the user's stated archival purpose. 4. Encrypt sensitive snapshots locally before upload. Encryption keys must not be stored in the IPFS payload, CID metadata, logs, or the same public channel used to share the CID. 5. Prefer a private or access-controlled storage mechanism when the user wants personal record-keeping rather than public publication. 6. Distinguish clearly between public governance metadata and private financial records in the Skill instructions. Public plaintext storage may be appropriate for governance proposals, but it should not be the default for user-specific position snapshots. 7. Warn users that losing control of a CID can disclose the content and that removing a local pin does not guarantee deletion from the wider IPFS network. 8. Minimize logging of plaintext payloads and CIDs in the MCP implementation and surrounding infrastructure.