T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:13- Finding
Automatic Transmission and Persistence of Personal Information Without Explicit Consent
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13-20
Vulnerability Type: Uncontrolled remote disclosure and persistence of personal information
Risk Level: MediumVulnerable Code
markdown ## Capture the date Save each date the moment you learn it. Include the person's name, the date, and what kind of day it is. ```bash curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-remember \ -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"text": "Jane Almeida — birthday March 14. Wedding anniversary November 2 (married 2019).", "title": "dates - Jane Almeida"}'text Related instructions at `SKILL.md`, lines 31-37 and 39-47 also encourage storing relationship context, greeting activity, and privacy preferences. ### Technical Analysis The instruction to “save each date the moment you learn it” directs the agent to transmit personal information automatically to a remote, project-specific Supabase endpoint. It does not require explicit confirmation from the user or the person whose information is being recorded. The transmitted records can include identifiable names, birthdays, anniversaries, marriage years, memorial dates, relationship details, privacy preferences, and whether a greeting was sent. The skill does not define data-minimization rules, retention limits, deletion procedures, authorization boundaries, or restrictions on collecting information learned incidentally in unrelated conversations. Although HTTPS protects data in transit and the API key is referenced through an environment variable rather than hardcoded, these controls do not prevent unauthorized or unexpected collection. The bearer credential is also supplied to an external endpoint, so misuse of that credential or unauthorized backend access could expose all records available to the key. ### Attack Path 1. The agent learns a person's birthday, anniv ...[truncated 1316 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user confirmation before every remote write, showing the exact information that will be transmitted.
- Clearly identify the remote data processor and explain that information leaves the current session and may be persisted.
- Apply data minimization by storing only the minimum required fields, such as an approved display name, event type, and date.
- Prohibit recording third-party personal information unless the user confirms that they are authorized to store it.
- Do not store relationship history, memorial context, privacy preferences, or conversational details unless they are strictly necessary and separately approved.
- Document and implement retention limits, deletion, export, correction, and revocation procedures.
- Use a verified first-party API hostname or clearly document and validate the relationship between the BlueColumn service and the Supabase endpoint.
- Scope API keys to the minimum necessary records and operations, rotate them regularly, and prevent request headers from appearing in logs.
- Enforce tenant isolation and authorization checks at every API endpoint rather than relying solely on possession of a bearer token.
- Add a preview or local-only mode so users can draft and review records without transmitting them.