T09 · Insecure Skill Coding Practices
Warning
- Location
- import.md:48
- Finding
- Session transcripts are delegated without enforced consent, redaction, or destination validation<![CDATA[ ## Vulnerability Details **File Location**: `import.md:48-85`, with the advisory-only warning at `import.md:97-100` **Vulnerability Type**: Sensitive-data exposure across an agent or provider boundary **Risk Level**: Medium ### Vulnerable Code ```text Task tool: subagent_type: "hookify:conversation-analyzer" prompt: | Find patterns to prevent from the following conversation and generate hooks: <conversation> {fetched session conversation content} </conversation> ``` ```text Task tool: subagent_type: "general-purpose" prompt: | Please analyze the following conversation: <conversation> {session data} </conversation> ``` ```text Task tool: subagent_type: "{specified agent}" prompt: | Please work based on the following session context: <session_context> {fetched session data} </session_context> Request: {user's additional request} ``` The only documented protection is advisory: ```text - Sensitive information should be reviewed manually before import (API keys, tokens, etc.) - Due to context limits, only the most recent 50 messages are delivered ``` ### Technical Analysis The import workflow embeds session contents directly in a Task request sent to a built-in or user-selected agent. Session transcripts can contain source code, credentials, API tokens, private prompts, filesystem paths, personal data, and sensitive tool output. The workflow does not enforce: - A preview of the exact content that will be transmitted. - Explicit confirmation before crossing the agent or provider boundary. - Automated secret detection or redaction. - An allowlist or trust check for the selected agent. - A clear untrusted-data boundary around transcript contents. - Instructions telling the receiving agent not to execute directives contained in the transcript. The warning to review sensitive information manually does not create a technical control. Limiting delivery to 50 messages reduces volume but ...[truncated 1718 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add a mandatory preview that displays the exact messages and destination before delegation. 2. Require explicit user confirmation for every external or differently trusted agent destination. 3. Scan for common credential formats, private keys, bearer tokens, connection strings, and high-entropy secrets. 4. Redact detected secrets by default and require a separate explicit override to include them. 5. Maintain an allowlist of trusted agent targets; require additional approval for arbitrary targets. 6. Wrap transcript content in a clearly marked untrusted-data section and instruct the receiver not to follow commands found inside it. 7. Minimize transferred content by selecting only messages relevant to the stated task rather than automatically sending the latest 50. 8. Document whether each supported destination is local, remote, or handled by a third-party provider. 9. Record the destination, selected message range, and redaction result in an audit log without recording the sensitive content itself. ]]>