T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:45
- Finding
- Shared Sessions Are Permitted to Read Raw Daily Memory Logs## Vulnerability Details **File Location**: `SKILL.md:45-50` **Vulnerability Type**: Inconsistent access control for persistent sensitive data **Risk Level**: Medium ### Vulnerable Configuration The relevant source instructions, translated into English, are: ```markdown ### Reading Rules - **Main sessions** (private conversations with the user): may freely read and write `MEMORY.md` - **Shared sessions** (group chats, Discord, multi-user scenarios): **must not load MEMORY.md** — prevents disclosure of private information - **Daily memory**: may be read in any session, but may only write to the current day's file ``` The related conventions describe daily files as raw logs: ```markdown - **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened - **Long-term:** `MEMORY.md` — your curated memories, like a human's long-term memory ``` ### Technical Analysis The skill applies a main-session-only access restriction to `MEMORY.md`, but explicitly permits daily memory files to be read in any session. This creates an inconsistent trust boundary because daily files are described as raw logs and may contain more detailed or sensitive information than the curated long-term memory. The control protects only one class of persistent memory rather than protecting data according to its sensitivity. A shared conversation, group chat, or other multi-user context can therefore load raw daily records even though the same context is prohibited from loading `MEMORY.md`. The project contains no executable exfiltration mechanism. Exploitation depends on an Agent following these instructions and subsequently exposing information from a daily log through its context or generated response. ### Attack Path 1. A user has a private session with the Agent. 2. The Agent records session details in `memory/YYYY-MM-DD.md` according to the daily-memory rules. 3. The daily file contains private conver ...[truncated 1134 chars]
- Remediation
- ## Remediation Suggestions 1. Apply the same main-session-only access restriction to `memory/YYYY-MM-DD.md`, `MEMORY.md`, and `memory/archive/`. 2. Prohibit loading any persistent memory in group chats, public channels, multi-user sessions, or contexts where participant identity and authorization cannot be established. 3. Require explicit user authorization before memory is loaded into a context whose privacy classification is uncertain. 4. Add a deny-by-default rule: if the Agent cannot determine whether a session is private, it must treat the session as shared. 5. Minimize sensitive content in daily logs and avoid recording credentials, authentication tokens, financial data, private identifiers, or unnecessary verbatim conversation content. 6. Separate private and shareable memory into distinct storage locations with explicit access policies. 7. Ensure automated distillation and maintenance jobs process memory only in a trusted private context and never include memory contents in public logs or outputs. 8. Add tests or policy checks verifying that shared-session prompts cannot cause daily or archived memory to be loaded.