T09 · Insecure Skill Coding Practices
- Location
SKILL.md:45- Finding
Unredacted Agent Context May Be Disclosed to an External Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45–64
Vulnerability Type: External disclosure of sensitive agent context
Risk Level: MediumVulnerable Code
bash curl -s -X POST https://darkmatterhub.ai/api/commit \ -H "Authorization: Bearer $DARKMATTER_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "toAgentId": "<RECIPIENT_AGENT_ID>", "payload": { "input": "<what this agent received>", "output": "<what this agent produced>", "memory": {} }, "agent": { "role": "<researcher|writer|reviewer>", "provider": "<anthropic|openai|local>", "model": "<model name>" }, "parentId": "<parent ctx_id if chaining>", "traceId": "<optional trace group>", "eventType": "commit" }'The skill also explicitly states at
SKILL.md, lines 24–26:text Data notice: This skill sends agent context to darkmatterhub.ai. DarkMatter is open source (MIT) and fully self-hostable: https://github.com/darkmatter-hub/darkmatterTechnical Analysis
The documented commit operation instructs the agent to send its received input, generated output, and potentially its memory to
darkmatterhub.ai. These fields can contain private conversations, credentials, proprietary material, system instructions, or unrelated information retained in the agent context.Although the documentation discloses that context is sent externally, it does not define data-minimization boundaries, mandatory redaction, secret scanning, or explicit per-payload approval. The presence of an API key protects access to the service but does not prevent sensitive information from being included in an authorized request.
This is an insecure skill design practice because broad context is transmitted without safeguards that distinguish task-relevant information from confidential data.
Attack Path
- A user or another source supplies sensitive info ...[truncated 1269 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to transmitting only the specific output explicitly selected by the user, rather than complete input, output, and memory.
- Display the exact destination and payload to the user and require explicit confirmation before transmission.
- Prohibit automatic inclusion of system prompts, credentials, API keys, environment variables, long-term memory, and unrelated conversation history.
- Add secret detection and redaction for API keys, passwords, tokens, private keys, and common sensitive-data formats.
- Use a structured allowlist of fields rather than accepting an unrestricted context object.
- Provide clear retention, access-control, deletion, and recipient-visibility documentation.
- Consider client-side encryption when context must only be readable by the intended recipient.
- Recommend self-hosting where users cannot permit third-party processing of confidential context.