T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:140
- Finding
- Automatic Plaintext Persistence of Sensitive Conversation and Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:140-208`; related onboarding behavior in `assets/ONBOARDING.md:32-69` and automatic loading in `assets/AGENTS.md:7-17` **Vulnerability Type**: Automatic collection and insecure persistent storage of potentially sensitive user data **Risk Level**: High ### Vulnerable Code ```markdown ## The WAL Protocol ⭐ NEW **The Law:** You are a stateful operator. Chat history is a BUFFER, not storage. `SESSION-STATE.md` is your "RAM" — the ONLY place specific details are safe. ### Trigger — SCAN EVERY MESSAGE FOR: - ✏️ **Corrections** — "It's X, not Y" / "Actually..." / "No, I meant..." - 📍 **Proper nouns** — Names, places, companies, products - 🎨 **Preferences** — Colors, styles, approaches, "I like/don't like" - 📋 **Decisions** — "Let's do X" / "Go with Y" / "Use Z" - 📝 **Draft changes** — Edits to something we're working on - 🔢 **Specific values** — Numbers, dates, IDs, URLs ### The Protocol **If ANY of these appear:** 1. **STOP** — Do not start composing your response 2. **WRITE** — Update SESSION-STATE.md with the detail 3. **THEN** — Respond to your human **The urge to respond is the enemy.** The detail feels so clear in context that writing it down seems unnecessary. But context will vanish. Write first. **Example:** ``` Human says: "Use the blue theme, not red" WRONG: "Got it, blue!" (seems obvious, why write it down?) RIGHT: Write to SESSION-STATE.md: "Theme: blue (not red)" → THEN respond ``` ### Why This Works The trigger is the human's INPUT, not your memory. You don't have to remember to check — the rule fires on what they say. Every correction, every name, every decision gets captured automatically. --- ## Working Buffer Protocol ⭐ NEW **Purpose:** Capture EVERY exchange in the danger zone between memory flush and compaction. ### How It Works 1. **At 60% context** (check via `session_status`): CLEAR the old buffer, start fresh 2. **Every message after 60%**: Append both human's ...[truncated 3464 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make all persistent conversation memory opt-in and explain what will be stored before enabling it. 2. Replace broad automatic capture with an explicit allowlist of task-state fields. 3. Never persist passwords, API keys, session tokens, authentication headers, private URLs, payment information, government identifiers, or health data. 4. Run secret and sensitive-data redaction before every write. 5. Do not store complete message bodies. Store concise, purpose-limited summaries approved by the user. 6. Apply restrictive permissions to memory directories and files, such as owner-only access where supported. 7. Encrypt sensitive state at rest using a key held outside the workspace. 8. Define retention limits and automatically remove expired session buffers. 9. Provide commands to inspect, edit, export, and delete all retained information. 10. Require explicit consent before recording onboarding answers concerning identity, relationships, goals, or work context. 11. Do not automatically load all historical memory into every session. Retrieve only records relevant to the current task. 12. Add tests confirming that representative tokens, credentials, private URLs, and sensitive personal data are rejected or redacted before persistence. ]]>