T09 · Insecure Skill Coding Practices
Warning
- Location
- CLAUDE.md:12
- Finding
- Plaintext Persistence of Page Deletion Credentials## Vulnerability Details **File Location**: `CLAUDE.md`, line 12 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```markdown - **`entries.json`** — Append-only log of all published pages. Every publish must log here with id, url, deletePhrase, title, contentType, sizeBytes, and createdAt. ``` ### Technical Analysis The repository instructs the agent to save every published page's `deletePhrase` in `entries.json`. A deletion phrase is a page-control credential because possession may grant authority to delete its associated published page. Persisting this credential in a plaintext, append-only project file violates secure secret-storage and least-exposure principles. The credential could subsequently be exposed through source-control commits, repository sharing, backups, build artifacts, diagnostic collection, or access by another local process or user. This persistence requirement is documented in `CLAUDE.md` but is not disclosed in the publishing workflow in `SKILL.md`, making it an unexpected security-sensitive side effect. At audit time, `entries.json` contained an empty `entries` array, so no deletion credential was currently exposed. ### Attack Path 1. A user asks the Skill to publish content to `saved.md`. 2. The publication service returns page metadata that includes a deletion phrase. 3. Following `CLAUDE.md`, the agent appends the page URL, title, deletion phrase, and related metadata to `entries.json`. 4. The populated file is committed, shared, backed up, included in an artifact, or read by another party with project access. 5. The party extracts the plaintext deletion phrase. 6. Where the service accepts that phrase as deletion authorization, the party uses it to delete the associated public page. ### Impact Assessment Successful exploitation could grant unauthorized deletion authority over each page whose deletion phrase is recorded. It may also reveal publication history, document ...[truncated 250 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `deletePhrase` from the `entries.json` logging schema. 2. Do not write deletion credentials to tracked repository files, ordinary logs, console output, or generated artifacts. 3. Return the deletion phrase directly to the requesting user through the intended secure response channel. 4. If persistence is explicitly required, use an operating-system credential manager or encrypted secret store with narrowly scoped access controls. 5. Apply restrictive filesystem permissions to any local metadata that must be retained. 6. Add local publication metadata files to `.gitignore` and artifact-exclusion rules. 7. Document all retained publication metadata and obtain user consent before storing security-sensitive values. 8. Rotate or invalidate any deletion phrases previously written to shared or committed copies of the log. 9. Add validation or automated secret scanning that rejects commits containing fields such as `deletePhrase`.