T09 · Insecure Skill Coding Practices
Warning
- Location
modules/mcp-coordination.md:24- Finding
Unrestricted External Storage of Sensitive Workflow and Context Data
- Content
View full analysis
Vulnerability Details
File Location:
modules/mcp-coordination.md:14-25,modules/mcp-coordination.md:52-63,modules/mcp-coordination.md:106-111,modules/mcp-coordination.md:205-216,modules/mcp-subagents.md:117-121,modules/mcp-subagents.md:132-140
Vulnerability Type: Uncontrolled external persistence of potentially sensitive data
Risk Level: MediumVulnerable Code
modules/mcp-coordination.md:14-25:python current_data = input_data results = [] for subagent in subagents: # Monitor context before each subagent if estimate_context_usage() > get_mecw_limit() * 0.8: apply_emergency_compaction() # Execute subagent with minimal context subagent_result = subagent.execute_focused_task({ 'data': current_data, 'context_limit': get_mecw_limit() * 0.4 }) current_data = subagent_result.get('next_input', current_data) results.append(subagent_result) # Store intermediate results externally store_intermediate_result(subagent.purpose, subagent_result)modules/mcp-coordination.md:52-63:python # Launch subagents with minimal context futures = [] for subagent, data_split in zip(subagents, data_splits): future = subagent.execute_async({ 'data': data_split, 'context_limit': get_mecw_limit() // len(subagents) }) futures.append(future) # Collect results with external storage results = [] for future in futures: result = future.get_result() store_external_result(result.subagent_id, result.data) results.append(result)modules/mcp-coordination.md:106-111:python def handle_context_overflow(subagent, current_state): """Emergency handling when subagent exceeds MECW limits""" # 1. Immediately store current state externally store_emergency_state(subagent.id, current_state)modules/mcp-coordination.md:205-216:text ...[truncated 4392 chars]- Remediation
View remediation
Remediation Suggestions
- Default to local, session-scoped storage and prohibit network-backed persistence unless the user explicitly approves it.
- Require an allowlisted storage destination with a documented trust boundary before any external write.
- Apply data minimization: persist only fields needed by the next processing stage rather than complete results or state objects.
- Prohibit full context snapshots. Replace them with non-sensitive operational metadata such as token counts, event types, and opaque correlation identifiers.
- Scan and redact credentials, API keys, authentication headers, personal information, database connection material, and other sensitive fields before storage.
- Require encryption in transit and at rest, least-privilege service identities, tenant isolation, and auditable access controls.
- Establish short retention periods and guaranteed deletion at workflow or session completion.
- Add confidentiality checks to
mcp-validation.md, including destination validation, consent verification, sensitivity classification, redaction verification, and fail-closed behavior. - Change emergency handling so context overflow does not automatically persist the complete current state. Store a minimal, sanitized recovery checkpoint instead.
- Clearly distinguish local temporary storage from remote external storage in all examples and documentation.