T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:12
- Finding
- Plaintext Persistence of Sensitive Health Information## Vulnerability Details **File Location**: `SKILL.md`, lines 12–13 **Vulnerability Type**: Plaintext storage of sensitive personal and health data **Risk Level**: Medium **Vulnerable instruction:** ```text 当用户需要查询或记录健康或体检问题时，更新并保存[本技能目录下的 references/my-healthy.md]（相对路径：skills/eatsth-by/references/my-healthy.md），如果没有该文件则自动生成，登记时需包含登记日期和时间信息。 个人健康记录可能包括：体检或已知的异常身体状况或症状；以往或新近发现的禁忌或不喜欢吃的食物;个人生活习惯等一切可能影响健康饮食推荐的个人因素。 ``` ### Technical Analysis The Skill explicitly directs the Agent to create or update `references/my-healthy.md` with medical examination results, known health abnormalities, symptoms, dietary restrictions, food preferences, lifestyle information, and timestamps. A Markdown file provides no encryption or field-level protection by itself. Although the Skill states elsewhere that health-record functionality is available only in the main session, it does not define or enforce filesystem access controls, encryption, data minimization, explicit consent, retention limits, secure deletion, or exclusion from source control and backups. A session-level instruction is not equivalent to a technical storage boundary. Exploitation does not grant new system privileges. It allows any actor or process that already has read access to the Skill directory, copied artifacts, backups, or repository history to obtain sensitive health information stored there. ### Attack Path 1. A user supplies symptoms, examination results, dietary contraindications, or lifestyle information. 2. Following the Skill instruction, the Agent writes that information and its timestamp to `references/my-healthy.md`. 3. The plaintext file remains in the Skill directory without a specified expiration or secure-deletion policy. 4. Another local process, tool, session, backup operator, or repository user with access to that directory or a copy of it reads the record. 5. The exposed information can be used for privacy invasion, profiling, discrimination, socia ...[truncated 709 chars]
- Remediation
- ## Remediation Suggestions 1. Obtain explicit, informed user consent before persisting any health information, and explain what will be stored, where it will be stored, and for how long. 2. Store only the minimum information necessary for dietary recommendations. Avoid retaining raw examination reports or unrelated medical details. 3. Replace the Markdown file with an approved protected data store that supports encryption at rest and authenticated, least-privilege access. 4. If local storage is unavoidable, place records outside the distributable Skill package, apply restrictive owner-only permissions, and encrypt the contents using managed keys. 5. Prevent generated records from entering source control, package archives, telemetry, logs, and unprotected backups. 6. Define retention limits and provide user-accessible review, correction, export, and secure-deletion mechanisms. 7. Enforce the main-session restriction through technical authorization checks rather than relying solely on natural-language instructions. 8. Avoid recording precise timestamps unless they are necessary for the stated functionality. 9. Document the threat model and verify that subprocesses, tools, and unrelated sessions cannot retrieve the protected record.