T09 · Insecure Skill Coding Practices
Warning
- Location
handler.sh:11- Finding
Unfiltered Conversation Payloads Stored in Plaintext
- Content
View full analysis
> "$LOG_FILE" 2>/dev/null echo "logged" >&2 ``` The destination is initialized earlier as a daily plaintext JSONL file: ```bash _SELF_DIR="$(cd "$(dirname "$0")" && pwd)" MEMORY_DIR="$_SELF_DIR/memory/daily" mkdir -p "$MEMORY_DIR" TODAY=$(date -u +%Y-%m-%d) LOG_FILE="$MEMORY_DIR/${TODAY}.jsonl" ``` ### Technical Analysis The post-response handler reads the complete standard-input payload and appends it to a persistent JSONL file. According to the documented data format, the payload can contain both the conversation message and generated result. No data-minimization, secret-redaction, consent, retention, encryption, or deletion controls are implemented. The directory and file are also created without explicit restrictive permissions, so their effective permissions depend on the runtime environment's `umask`. Consequently, sensitive content supplied during a conversation—including API tokens, passwords, personal information, proprietary source code, internal prompts, or confidential business data—can be retained in plaintext. The timestamp added through `jq` does not sanitize or reduce the original payload. This issue does not provide remote code execution, privilege escalation, or demonstrated network exfiltration. Exploitation requires the ability to include sensitive material in a processed conversation and subsequently obtain local read access to the generated memory files. ### Attack Path 1. A user or integrated system submits a conversation containing sensitive information. 2. The AI generates a response, causing the configure ...[truncated 1058 chars]- Remediation
View remediation
/dev/null`. - Validate the input schema and fail closed when the payload is malformed. - Report whether a record was actually written instead of always printing `logged`. ]]>