T09 · Insecure Skill Coding Practices
- Location
references/file-architecture.md:19- Finding
Sensitive Credentials Recommended for Persistent Agent Memory and Retrieval Indexing
- Content
View full analysis
Vulnerability Details
File Location:
references/file-architecture.md, lines 19-25 and 69-79
Vulnerability Type: Sensitive data stored in persistent agent context and searchable memory
Risk Level: MediumVulnerable Code Snippets
markdown ├── TOOLS.md — Environment: SSH hosts, services, credentials mapmarkdown **MEMORY.md** — curated, compact, durable facts. Credentials, infrastructure, decisions, preferences. Updated manually when something important should persist. Keep under 5KB.json { "memory": { "backend": "qmd", "qmd": { "includeDefaultMemory": true, "update": { "interval": "5m", "onBoot": true } } } }Technical Analysis
The Skill explicitly recommends recording credentials in
MEMORY.mdand describes a credentials map inTOOLS.md. These bootstrap files are persistently stored and loaded into agent context at session startup. The recommended QMD configuration also enables default-memory indexing.Compaction resilience does not require retaining secret values. Storing credentials in routinely injected or searchable memory violates least-data and least-exposure principles. It expands secret exposure to model context, session processing, retrieval results, workspace backups, and any users or processes capable of reading the workspace.
Although the Skill contains no direct exfiltration mechanism, prompt injection or an unauthorized workspace reader could exploit this architecture to discover credentials.
Attack Path
- An operator follows the Skill and stores passwords, tokens, private keys, or other credentials in
MEMORY.mdorTOOLS.md. - The files persist across sessions and may be loaded automatically as bootstrap context.
- Default memory is indexed by QMD under the recommended configuration.
- An attacker introduces a malicious prompt through user input or other untrusted content, or gains read access to the workspace.
- The attac ...[truncated 805 chars]
- An operator follows the Skill and stores passwords, tokens, private keys, or other credentials in
- Remediation
View remediation
Remediation Suggestions
- Replace the recommendation to store credentials with an explicit prohibition against retaining passwords, API tokens, private keys, session cookies, recovery codes, or complete connection strings in agent memory.
- Store secrets in a dedicated secret manager or operating-system credential store. Memory files should contain only non-sensitive aliases, resource identifiers, or secret-manager reference names.
- Clarify that a “credentials map” must contain metadata only, such as the secret's logical name and retrieval procedure, never its value.
- Exclude any potentially sensitive files and directories from QMD indexing rather than relying solely on
includeDefaultMemory: true. - Apply restrictive filesystem permissions and ensure memory files are excluded from public repositories, broad backups, logs, and artifact uploads.
- Define retention and deletion policies for daily notes and archives. Archival should not be treated as a security boundary.
- Add secret-detection checks before memory writes and indexing, with redaction or rejection of likely credentials.
- Apply minimum privileges and rotation policies to any credentials that may already have been stored. Remove them from memory, indexes, transcripts, backups, and archives, then rotate them.