T09 · Insecure Skill Coding Practices
- Location
SKILL.md:139- Finding
Plaintext Cross-Session Storage of Sensitive Personal Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 139–177
Vulnerability Type: Plaintext persistence and broad reuse of personal data
Risk Level: MediumVulnerable Code Snippet
markdown ## User Context 本 Skill 的产出依赖以下用户信息，通过 `MEMORY.md` 跨领域、跨会话共享。 **读取**：每次触发时，**主动读取**本目录下的 `MEMORY.md`。文件存在且包含当前领域所需字段时，直接使用，不再重复询问。 **写入**：`MEMORY.md` 不存在或缺少必要字段时，按需引导用户提供，收集完成后写入 `MEMORY.md`。 **更新**：用户主动要求修改个人信息（如"我的生日填错了"）时，更新 `MEMORY.md` 中对应字段。 **MEMORY.md 格式：** ```markdown # 用户玄学档案 ## 基础信息 - 公历生日：1990-05-15 - 农历生日：庚午年四月廿一 - 出生时辰：未时（13:00-15:00） - 出生地点：上海 - 性别：男 - 英文全名：San Zhangmarkdown | 英文全名 | 护照/出生证上的全名 | 数字命理 |Technical Analysis
The Skill instructs the agent to collect and persist a user's birth date, birth time, location, sex, and passport- or birth-certificate-based full name in a plaintext Markdown file. It further directs the agent to reuse this profile across domains and sessions and to read it automatically whenever the Skill is triggered.
The design does not specify explicit consent before persistence, file-access restrictions, encryption, retention limits, automatic expiration, field-level deletion, full-profile deletion, or purpose-based isolation. Automatic loading of a shared profile can also expose more personal information than is necessary for the selected fortune-telling domain.
This is an insecure data-handling practice rather than evidence of malicious exfiltration. The audited project contains no code that sends the information over a network.
Attack Path
- A user invokes the Skill and selects a domain requiring personal information.
- The agent requests birth information, location, sex, or a legal full name.
- Following the Skill instructions, the agent writes those values to
MEMORY.mdin plaintext. - The file remains available across later sessions.
- A subsequent agent, Skill, user, or local process with workspace-rea ...[truncated 850 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to session-only processing and ask for explicit, informed opt-in before creating a persistent profile.
- Explain which fields will be stored, why they are needed, how long they will remain, and which Skills can access them.
- Apply data minimization by storing only fields required for the selected domain.
- Avoid requesting a passport- or birth-certificate-based legal name; accept a user-provided display name or session-only input where possible.
- Separate records by purpose or domain instead of maintaining one broadly shared profile.
- Read only the fields required for the current operation rather than automatically loading the complete profile.
- Restrict file permissions to the minimum necessary principal and use protected storage where supported.
- Define retention and automatic-expiration policies for stored personal data.
- Provide documented commands for viewing, correcting, deleting individual fields, and permanently purging the entire profile.
- If
MEMORY.mdmust remain plaintext, prominently warn users of the local confidentiality limitations before writing it.