T09 · Insecure Skill Coding Practices
Warning
- Location
- tool.py:18
- Finding
- Plaintext Storage and Disclosure of Potentially Sensitive Agent Reasoning## Vulnerability Details **File Location**: `tool.py`, lines 18-29, 32-49, and 83-85 **Vulnerability Type**: Plaintext sensitive-data storage and output **Risk Level**: Medium ### Vulnerable Code ```python log_entry = { "timestamp": timestamp, "epoch_ms": step_data.get("epoch", timestamp * 1000), "state_embedding": step_data.get("state", []), "action_log_prob": step_data.get("log_prob", 0.0), "thought_chain": step_data.get("thought", ""), "novelty_score": step_data.get("novelty", 0.0), "metadata": step_data.get("meta", {}) } with open("agent_dreams.jsonl", "a") as f: f.write(json.dumps(log_entry) + "\n") ``` ```python def analyze_dreams(threshold: float = 0.8) -> List[Dict[str, Any]]: """Parse recorded dreams and extract high-novelty thought chains.""" insights = [] if not os.path.exists("agent_dreams.jsonl"): print("No dream data found. Run with --record first.") return [] with open("agent_dreams.jsonl", "r") as f: for line in f: try: entry = json.loads(line.strip()) if entry["novelty_score"] >= threshold: insights.append(entry) except json.JSONDecodeError: continue # Skip malformed lines return insights ``` ```python for i, dream in enumerate(insights, 1): print(f"{i}. [{dream['timestamp']}] {dream['thought'][:100]}...") ``` ### Technical Analysis The application deliberately captures the value supplied through `--thought`, together with state embeddings and arbitrary metadata, and stores the resulting record in `agent_dreams.jsonl`. The file is created using the process's default permissions, subject only to its current `umask`. No explicit private permission mode, encryption, secret filtering, data minimization, or retention policy is applied. Internal reasoning and metadata can contain credentials ...[truncated 1506 chars]
- Remediation
- ## Remediation Suggestions - Do not collect hidden reasoning or unrestricted internal thought chains. Accept a deliberately sanitized summary containing only information needed for analysis. - Document that journal input must not contain credentials, tokens, personal data, or proprietary context. - Create the journal in a private, application-controlled directory rather than the caller's current working directory. - Create new files with permissions equivalent to `0600`, independently of the ambient `umask`. - Apply schema validation and secret redaction to thought and metadata fields before persistence. - Encrypt sensitive records at rest when persistent storage is necessary, with keys kept separately from the journal. - Add configurable retention limits, secure deletion, and an explicit command for clearing stored records. - Avoid printing raw reasoning. Display sanitized summaries and require an explicit opt-in before outputting sensitive fields. - Warn users when output is likely to enter CI or centralized logs.