T09 · Insecure Skill Coding Practices
Warning
- Location
- references/file-architecture.md:19
- Finding
- Sensitive Credentials Recommended for Persistent Agent Memory and Retrieval Indexing## Vulnerability Details **File Location**: `references/file-architecture.md`, lines 19-25 and 69-79 **Vulnerability Type**: Sensitive data stored in persistent agent context and searchable memory **Risk Level**: Medium ### Vulnerable Code Snippets ```markdown ├── TOOLS.md — Environment: SSH hosts, services, credentials map ``` ```markdown **MEMORY.md** — curated, compact, durable facts. Credentials, infrastructure, decisions, preferences. Updated manually when something important should persist. Keep under 5KB. ``` ```json { "memory": { "backend": "qmd", "qmd": { "includeDefaultMemory": true, "update": { "interval": "5m", "onBoot": true } } } } ``` ### Technical Analysis The Skill explicitly recommends recording credentials in `MEMORY.md` and describes a credentials map in `TOOLS.md`. These bootstrap files are persistently stored and loaded into agent context at session startup. The recommended QMD configuration also enables default-memory indexing. Compaction resilience does not require retaining secret values. Storing credentials in routinely injected or searchable memory violates least-data and least-exposure principles. It expands secret exposure to model context, session processing, retrieval results, workspace backups, and any users or processes capable of reading the workspace. Although the Skill contains no direct exfiltration mechanism, prompt injection or an unauthorized workspace reader could exploit this architecture to discover credentials. ### Attack Path 1. An operator follows the Skill and stores passwords, tokens, private keys, or other credentials in `MEMORY.md` or `TOOLS.md`. 2. The files persist across sessions and may be loaded automatically as bootstrap context. 3. Default memory is indexed by QMD under the recommended configuration. 4. An attacker introduces a malicious prompt through user input or other untrusted content, or gains read access to the workspace. 5. The attac ...[truncated 805 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the recommendation to store credentials with an explicit prohibition against retaining passwords, API tokens, private keys, session cookies, recovery codes, or complete connection strings in agent memory. 2. Store secrets in a dedicated secret manager or operating-system credential store. Memory files should contain only non-sensitive aliases, resource identifiers, or secret-manager reference names. 3. Clarify that a “credentials map” must contain metadata only, such as the secret's logical name and retrieval procedure, never its value. 4. Exclude any potentially sensitive files and directories from QMD indexing rather than relying solely on `includeDefaultMemory: true`. 5. Apply restrictive filesystem permissions and ensure memory files are excluded from public repositories, broad backups, logs, and artifact uploads. 6. Define retention and deletion policies for daily notes and archives. Archival should not be treated as a security boundary. 7. Add secret-detection checks before memory writes and indexing, with redaction or rejection of likely credentials. 8. Apply minimum privileges and rotation policies to any credentials that may already have been stored. Remove them from memory, indexes, transcripts, backups, and archives, then rotate them.