T09 · Insecure Skill Coding Practices
- Location
SKILL.md:62- Finding
Unsafe Cloud and Email Storage Guidance for Identity-Document Scans
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md, line 62references/travel-documents.md, line 51
Vulnerability Type: Sensitive data stored without defined security controls
Risk Level: MediumVulnerable Snippets
SKILL.md:62:text Electronic backup: Store scanned copies in cloud storage and email.references/travel-documents.md:51:text 2. Electronic backup: Store scanned copies in cloud storage and email.The snippets above are English renderings of the corresponding source instructions.
Technical Analysis
The Skill recommends placing scanned travel documents in cloud storage and email. In context, these documents can include passports, identity cards, visas, birth certificates, insurance records, and other personally identifiable information.
The guidance does not require:
- Client-side or end-to-end encryption
- Multi-factor authentication
- Private access controls or restricted sharing
- A trusted storage provider
- Redaction of unnecessary document fields
- Retention limits and secure deletion
- Monitoring for unauthorized access
- Separation of encryption keys from stored files
Email attachments and ordinary cloud files are frequently readable after mailbox compromise, credential theft, session-token theft, accidental public sharing, or provider-side disclosure. Creating multiple unprotected copies also expands the number of systems through which the documents may be exposed.
This is an insecure handling practice rather than programmatic exfiltration. The audited project contains no implementation that automatically uploads or transmits documents.
Attack Path
- A user follows the Skill's recommendation and scans a passport or another identity document.
- The user uploads the unencrypted scan to ordinary cloud storage and sends or saves another copy through email.
- The cloud account, mailbox, recovery account, authenticated ses ...[truncated 1348 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the current recommendation with security-specific document-handling guidance:
- Prefer encrypted local storage or a reputable end-to-end encrypted document vault.
- If cloud storage is necessary, encrypt each file locally before upload using authenticated encryption and a strong, unique passphrase.
- Do not send unencrypted passport or identity-document scans through ordinary email.
- Protect storage and email accounts with phishing-resistant multi-factor authentication and unique passwords.
- Disable public-link sharing and grant access only to specifically authorized accounts.
- Redact document fields that are unnecessary for the intended emergency or travel purpose.
- Store decryption keys or passphrases separately from the encrypted files.
- Define a short retention period and securely delete copies after travel.
- Review account sessions, sharing permissions, and access logs regularly.
- Warn users that destination authorities, airlines, hotels, and insurers may have different document requirements and that copies should only be provided through verified official channels.
Apply the same correction to
references/travel-documents.md:51so the reference document does not reintroduce the unsafe recommendation.