T09 · Insecure Skill Coding Practices
Error
- Location
- references/export-manifest.txt:5
- Finding
- Broad agent context is uploaded without comprehensive sensitive-data inspection<![CDATA[ ## Vulnerability Details **File Location**: `references/export-manifest.txt:5-15`; `scripts/sync.sh:45-62, 81-99, 143`; `scripts/scan_secrets.py:20-46, 82-103` **Vulnerability Type**: Incomplete sensitive-data validation before network transmission **Risk Level**: High ### Vulnerable Code `references/export-manifest.txt:5-15`: ```text AGENTS.md IDENTITY.md SOUL.md TOOLS.md USER.md # Skills (add more as you create them) skills/ # Memories memory/ ``` `scripts/sync.sh:45-62`: ```bash while IFS= read -r path; do # strip comments/blank path="${path%%#*}" path="$(echo "$path" | xargs || true)" [[ -z "$path" ]] && continue src="$WORKSPACE_DIR/$path" if [[ -d "$src" ]]; then mkdir -p "$SYNC_REPO_DIR/$path" # Preserve directory paths exactly as listed in the manifest. rsync -a --delete --exclude '.git/' "$src/" "$SYNC_REPO_DIR/$path/" elif [[ -f "$src" ]]; then mkdir -p "$SYNC_REPO_DIR/$(dirname "$path")" rsync -a "$src" "$SYNC_REPO_DIR/$path" else echo "WARN: not found: $path" >&2 fi done < "$MANIFEST" ``` `scripts/scan_secrets.py:33-46, 82-103`: ```python SCAN_EXTS = { ".md", ".txt", ".json", ".yml", ".yaml", ".js", ".ts", ".php", ".sh", ".py", ".env", "", # extensionless } SKIP_DIR_NAMES = {".git", "node_modules", "vendor", ".archive"} SKIP_FILE_NAMES = {"hosts.yml", "known_hosts", "known_hosts.old"} ``` ```python def should_scan(p: Path) -> bool: if p.name in SKIP_FILE_NAMES: return False # Skip very large files try: if p.stat().st_size > 2_000_000: return False except FileNotFoundError: return False ext = p.suffix.lower() if ext not in SCAN_EXTS: # still scan extensionless small text files return False if looks_binary(p): return False return True ``` `scripts/sync.sh:143`: ```bash git -C "$SYNC_REPO_DIR" push -u origin main ``` ### Technical Analysis The de ...[truncated 2482 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the default `memory/` export with a narrowly curated path such as `memory/public/`. 2. Require users to enumerate individual Skills or files instead of exporting the complete `skills/` tree. 3. Fail closed when an allowlisted file cannot be scanned because it is binary, oversized, unreadable, or uses an unsupported type. 4. Maintain a strict permitted-extension and maximum-size policy for remotely synchronized content. 5. Add entropy-based detection and structured checks for additional credential formats, private keys, cookies, session tokens, connection strings, and personal data. 6. Scan the exact Git index or commit tree that will be pushed, not merely a broad working-directory view. 7. Present a complete first-run inventory of files and byte sizes and require explicit user approval before the initial upload. 8. Validate that the destination is an approved private repository controlled by the user before pushing. 9. Document clearly that heuristic scanning cannot establish that content is non-sensitive. ]]>