T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:8
- Finding
- Automatic External Persistence of Sensitive Financial Context Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–40 **Vulnerability Type**: Unconsented transmission and persistent storage of sensitive financial data **Risk Level**: Medium ### Vulnerable Code ```markdown Remember finances and budgets.. Powered by BlueColumn (bluecolumn.ai) persistent vector memory. ## Setup Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1` ## Store ```bash curl -X POST .../agent-remember \ -H "Authorization: Bearer <key>" \ -H "Content-Type: application/json" \ -d '{"text": "Budget Jul: $4k, spent $3.2k. Subscriptions: $89/mo total.", "title": "finance-memory - note"}' ``` ## Quick note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer <key>" \ -H "Content-Type: application/json" \ -d '{"text": "Budget Jul: $4k, spent $3.2k. Subscriptions: $89/mo total.", "tags": ["finance-memory"]}' ``` ## Workflow 1. On new context, first recall: `What's my spending trend this quarter?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill instructs the agent to send financial context to an external Supabase-hosted API and persist a summary after an interaction. Financial discussions can contain highly sensitive information, including budgets, transaction details, income, debts, subscriptions, account references, and personally identifying information. The workflow does not require the agent to: - Obtain explicit user consent before transmitting or persisting information. - Present the exact content that will be sent for user approval. - Minimize or redact sensitive fields. - Exclude credentials, account numbers, transaction identifiers, or personal data. - Explain retention, deletion, access-control, or data-governance policies. - Confirm that the user intends storage during every relevant interaction. ...[truncated 2247 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user consent before every persistent storage operation. 2. Show the user the exact summary and destination before transmission, and require affirmative approval. 3. Make persistence opt-in rather than an automatic final workflow step. 4. Apply data minimization and redact account numbers, credentials, payment-card data, transaction identifiers, addresses, and other unnecessary personal information. 5. Provide clear retention, deletion, export, and access-control documentation. 6. Offer commands that allow users to inspect and delete previously stored financial memories. 7. Clearly document the relationship between `bluecolumn.ai` and the configured Supabase hostname, and verify endpoint ownership before sending data. 8. Restrict API credentials to the minimum required endpoints and permissions, rotate them regularly, and never include them in stored summaries or logs. 9. Separate users and agents at the backend so memories cannot be recalled across unrelated identities or tenants. 10. Add a policy guard that prevents automatic storage when the context contains secrets, authentication data, full financial account identifiers, or other highly sensitive information. ]]>