T09 · Insecure Skill Coding Practices
- Location
references/directory-master-list.md:139- Finding
Insecure and Contradictory Storage of Directory Account Credentials
- Content
View full analysis
Vulnerability Details
File Location:
references/directory-master-list.md:139-149; related contradictory instruction atSKILL.md:166
Vulnerability Type: Plaintext sensitive-data handling and insecure credential-management guidance
Risk Level: MediumVulnerable Instructions
references/directory-master-list.md:139-149:markdown ## Submission Tracking Template Track every submission with these fields: - Directory Name - URL - Date Submitted - Login Email - Password - Status (Submitted / Pending Verification / Verified / Live / Rejected) - Listing URL (once live) - DoFollow / NoFollow - DA/DR - NotesSKILL.md:166:markdown | Email verification | Flag which inbox to check; provide login credentials |These instructions contradict the safer rules in
SKILL.md:34-35, which state:markdown > 5. **Track submissions in an external tracker.** Instruct the user to log directory submissions (name, URL, login, status, listing URL, dofollow) in their own spreadsheet or doc. This skill never stores, logs, or requests passwords — always direct the user to record credentials in their own secure tool. > 6. **Never ask for passwords in chat.** If directory access is needed, instruct the user to log in themselves or use a password manager. Never collect or repeat credentials conversationally.Technical Analysis
The directory submission template explicitly includes a
Passwordfield. Because the surrounding Skill recommends external spreadsheets or documents for submission tracking, a user could reasonably interpret this template as an instruction to store reusable passwords in a general-purpose document. Such documents commonly lack secret-specific protections, may synchronize to third-party services, and are often shared with coworkers, contractors, or agents.The instruction to “provide login credentials” introduces an additional disclosure path. It may lea ...[truncated 2315 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
Passwordfield from the submission-tracking template. - Replace it with a non-secret reference such as:
markdown - Login Email - Password Manager Record Name or ID - Change
SKILL.md:166from “provide login credentials” to:markdown | Email verification | Identify the inbox that will receive the verification message. The account owner must sign in and complete verification without sharing credentials in chat. | - Add an explicit prohibition against storing passwords, recovery codes, API keys, session cookies, or one-time verification codes in spreadsheets, ordinary documents, chat messages, or project files.
- Require a reputable password manager with access controls, encryption, audit logging, and scoped organizational sharing when multiple authorized staff members require account access.
- Recommend unique passwords and multifactor authentication for each directory, business-profile, email, and social-media account.
- Keep operational trackers limited to non-secret metadata such as the directory name, public listing URL, account owner, login email, submission status, and password-manager record reference.
- Reconcile all reference files with the top-level credential-handling rules so lower-priority workflow instructions cannot contradict the stated security policy.
- Remove the