T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Plaintext Credential Persistence in a Workspace Markdown File
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–30
Vulnerability Type: Plaintext storage of authentication credentials
Risk Level: HighVulnerable Code Snippet
markdown ## 凭据管理 - 这是一个可发布技能，`SKILL.md` 中不得包含任何真实账号、密码、Cookie、Token 或其他敏感信息。 - 首次使用时，如果本地未保存学邦凭据，先向用户索取： - 登录账号 - 登录密码 - 获取后，将凭据写入本地私有笔记 `workspace/TOOLS.md`。 - 后续执行时，优先从 `workspace/TOOLS.md` 读取凭据；只有在缺失或用户要求更新时才再次询问。 - 如果用户明确要求"不保存"，则仅本次使用，任务结束后不在任何文件中落盘。Technical Analysis
The skill directs the agent to collect a user's EDU.BOSS username and password and persist them in
workspace/TOOLS.md. A Markdown workspace file is not a dedicated encrypted credential store and provides no documented encryption, access isolation, retention control, or protection against accidental inclusion in backups or repositories.Although users may explicitly request that credentials not be saved, persistence is the default behavior. The instruction not to place credentials directly in
SKILL.mdmerely relocates the secret and does not secure it. Any process, agent, extension, or person able to read the workspace may potentially recover the credentials.The declared
allowed-toolslist contains onlybrowser, while the instructions require reading and writingworkspace/TOOLS.md. This mismatch may limit execution in a correctly sandboxed environment, but it does not eliminate the insecure credential-handling design.Attack Path
- A user invokes the skill to access EDU.BOSS data.
- The skill requests the user's login account and password.
- Unless the user explicitly opts out, the agent writes both credentials to
workspace/TOOLS.md. - A separate agent, extension, local user, backup process, synchronization service, or accidental repository commit obtains the workspace file.
- The exposed credentials are extracted from the plaintext document.
- An attacker uses them to authenticate to the EDU.BOSS service, subject ...[truncated 787 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instructions that write usernames or passwords to
workspace/TOOLS.mdor any other ordinary workspace document. - Make session-only credential handling the default. Keep secrets only in memory for the minimum time needed and discard them when the operation ends.
- If persistence is necessary, integrate a dedicated OS keychain or encrypted secret manager with strict access controls, scoped secret identifiers, and audit logging.
- Require explicit, informed user consent before storing credentials; never rely on an opt-out model.
- Store only the minimum required secret and avoid retaining passwords when a short-lived, revocable token or delegated authentication mechanism is available.
- Define credential deletion and rotation procedures, including removal of any credentials previously written to
workspace/TOOLS.md. - Prevent secret-bearing files from entering source control, logs, snapshots, backups, or synchronization systems. Use ignore rules and automated secret scanning as defense-in-depth measures, not as substitutes for secure storage.
- Ensure the skill's declared tool permissions accurately reflect required functionality while preserving least privilege.
- Remove the instructions that write usernames or passwords to