T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:147
- Finding
- Unbounded Persistent Capture of Conversation Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:147-208` **Additional Locations**: `SKILL-v3-draft.md:138-199` **Vulnerability Type**: Excessive plaintext persistence of potentially sensitive conversation data **Risk Level**: Medium ### Vulnerable Code ```markdown ### Trigger — SCAN EVERY MESSAGE FOR: - ✏️ **Corrections** — "It's X, not Y" / "Actually..." / "No, I meant..." - 📍 **Proper nouns** — Names, places, companies, products - 🎨 **Preferences** — Colors, styles, approaches, "I like/don't like" - 📋 **Decisions** — "Let's do X" / "Go with Y" / "Use Z" - 📝 **Draft changes** — Edits to something we're working on - 🔢 **Specific values** — Numbers, dates, IDs, URLs ### The Protocol **If ANY of these appear:** 1. **STOP** — Do not start composing your response 2. **WRITE** — Update SESSION-STATE.md with the detail 3. **THEN** — Respond to your human ``` ```markdown ## Working Buffer Protocol ⭐ NEW **Purpose:** Capture EVERY exchange in the danger zone between memory flush and compaction. ### How It Works 1. **At 60% context** (check via `session_status`): CLEAR the old buffer, start fresh 2. **Every message after 60%**: Append both human's message AND your response summary 3. **After compaction**: Read the buffer FIRST, extract important context 4. **Leave buffer as-is** until next 60% threshold ### Buffer Format ```markdown # Working Buffer (Danger Zone Log) **Status:** ACTIVE **Started:** [timestamp] --- ## [timestamp] Human [their message] ## [timestamp] Agent (summary) [1-2 sentence summary of your response + key details] ``` ### Why This Works The buffer is a file — it survives compaction. Even if SESSION-STATE.md wasn't updated properly, the buffer captures everything said in the danger zone. After waking up, you review the buffer and pull out what matters. **The rule:** Once context hits 60%, EVERY exchange gets logged. No exceptions. ``` ### Technical Analysis The write-ahead logging trigger is broad enough to m ...[truncated 2005 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make persistent memory explicitly opt-in during setup. 2. Replace “every exchange” logging with narrowly scoped, task-critical summaries. 3. Add a sensitivity classifier that blocks storage of credentials, tokens, private keys, financial information, health information, government identifiers, and private third-party data. 4. Support explicit commands such as “do not remember this,” “forget this,” and “show what you stored.” 5. Redact query parameters, authentication fragments, and identifiers from persisted URLs. 6. Apply restrictive permissions to memory files and directories, such as owner-only access where supported. 7. Define retention periods and automatically expire raw working-buffer entries after successful compaction recovery. 8. Store provenance, timestamp, purpose, and expiration metadata with each retained item. 9. Keep raw transcripts out of long-term memory unless the user separately approves their retention. 10. Document how memory files interact with backups, semantic indexes, source control, and other installed Skills. ]]>