T09 · Insecure Skill Coding Practices
- Location
references/file-rules.md:20- Finding
Plaintext Archival of Credentials and Sensitive Configuration
- Content
View full analysis
Vulnerability Details
File Location:
references/file-rules.md:20-38, with supporting instructions atSKILL.md:121-122
Vulnerability Type: Plaintext storage and duplication of sensitive data
Risk Level: MediumRelevant source excerpt translated into English:
markdown ## Metadata - The authentication key for the xxx API is private-00912ksi - The project deployment server address is 192.168.1.100:8080 ## code.md Store all code snippets, scripts, and configuration-file contents. Preserve the original code without modification. ## resource/ Copy local files mentioned by the user into this directory.Supporting archive constraints from
SKILL.md:121-122, translated into English:markdown - Do not lose information; retain extra information rather than omit anything. - Preserve code completely without truncation or omission.Technical Analysis
The skill explicitly instructs the agent to preserve authentication keys, scripts, configuration contents, and referenced local files without modification. It also requires retaining all information rather than omitting potentially sensitive content.
These rules create an insecure data-handling workflow because they define no secret-detection, redaction, exclusion, encryption, access-control, or retention requirements. A document containing API tokens, passwords, private keys, connection strings, internal addresses, or other credentials can therefore be duplicated into searchable Markdown files such as
meta.mdorcode.md. Referenced files can likewise be copied into the archive'sresource/directory.The credential shown in the documentation appears to be an example rather than a confirmed active secret. The vulnerability is the prescribed handling of future real credentials, not proof that the displayed value is usable.
Attack Path
- A user supplies a note, source file, configuration file, or referenced resource c ...[truncated 1221 chars]
- Remediation
View remediation
Remediation Suggestions
- Add secret scanning before any content is archived. Detect API keys, access tokens, passwords, private keys, connection strings, cloud credentials, and high-entropy values.
- Redact detected secrets by default and record only a placeholder such as
[REDACTED SECRET]. - Exclude sensitive file types and locations by default, including
.envfiles, credential stores, SSH keys, cloud credential directories, password databases, and production configuration files. - Require explicit, informed user confirmation before retaining any detected sensitive value or copying a potentially sensitive resource.
- Store archives with restrictive permissions limited to the current user. Avoid shared or world-readable directories.
- Support encryption at rest when confidential records must be preserved.
- Prevent generated archives from being committed accidentally by adding appropriate ignore rules and clear warnings.
- Apply data-minimization and retention policies instead of requiring unconditional preservation of all content.
- Replace credential-like documentation examples with unmistakable placeholders such as
REDACTED_API_KEY. - Document a secure deletion and credential-rotation procedure for cases where secrets have already been archived.