T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:18- Finding
Plaintext Personal and Health-Related Profile Data
- Content
View full analysis
memorização. Amor pelo conteúdo em todas as disciplinas. - **Modo de estudo:** Conversa contínua e natural. Sem paredes entre disciplinas. Sem aulas formais. - **Setup:** Claude.ai (central), caderno (exatas), flashcards SRS, NotebookLM, Claude Cowork - **Postura:** deitado (mobile) ou no computador — adaptar tom ao contexto ``` ### Technical Analysis The Skill definition directly embeds a learner's name, educational objective, ADHD status, professional profile, study behavior, software environment, and usage context. The ADHD reference is health-related information, while the remaining attributes enable personal and behavioral profiling. Because this data is stored in the Skill package rather than supplied through access-controlled runtime configuration, it accompanies every copy of the project. Anyone who can download, inspect, receive, or access logs containing the package can recover the information without authentication beyond access to the package itself. No evidence indicates that the project transmits this information to an external service or uses it to gain system privileges. The weakness is therefore limited to confidentiality and privacy exposure rather than code execution, privilege escalation, or system compromise. ### Attack Path 1. The Skill package is published, shared, archived, logged, or otherwise made available to an unintended recipient. 2. The recipient opens `SKILL.md`. 3. The recipient reads lines 18–26 and extracts the learner's name, health-relate ...[truncated 924 chars]- Remediation
View remediation