T09 · Insecure Skill Coding Practices
Warning
- Location
- references/iteration-notes.md:3
- Finding
- Persistent Plaintext Logging of User Requests## Vulnerability Details **File Location**: `references/iteration-notes.md`, lines 3-12 **Vulnerability Type**: Plaintext storage of potentially sensitive user data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Use this file to record what the skill gets wrong in real usage. ## Things worth logging - user request - what was recommended - what worked - what felt off - whether the recommendations were too obvious, too niche, too shallow, or too random - any source-quality issue ``` ### Technical Analysis The guidance instructs maintainers or agents to record raw user requests in a persistent project file. Recommendation requests can include private conversation context, personal preferences, confidential project details, identifiers, or credentials accidentally supplied by a user. No safeguards require user consent, data minimization, redaction, access control, retention limits, secure storage, or deletion. Because the designated log is within the publishable skill directory, its contents may subsequently enter version control or a distributed package. This is an insecure data-handling practice rather than evidence of intentional exfiltration. The audit found no mechanism that automatically writes the data or transmits it externally. ### Attack Path 1. A user submits a recommendation request containing private or confidential context. 2. A maintainer or capable agent follows the refinement guidance in `references/iteration-notes.md`. 3. The raw request is copied into that persistent file. 4. The project directory is committed to version control, shared with collaborators, backed up, or published. 5. Anyone with access to the resulting repository or package can read the retained user content. ### Impact Assessment An attacker cannot directly gain system privileges through this issue. The affected scope is the confidentiality of logged user content. Potential exposure includes personal interests, conversation history, project informati ...[truncated 210 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to store raw user requests by default. 2. Record anonymized failure categories and aggregate quality metrics instead of conversation text. 3. Require explicit informed consent before retaining any request content. 4. Redact personal identifiers, credentials, tokens, confidential project details, and unnecessary conversational context. 5. Store authorized diagnostic records outside the publishable skill directory in an access-controlled location. 6. Define a short retention period and a documented deletion process. 7. Add the diagnostic storage location to version-control and packaging exclusions. 8. If exact examples are necessary, use synthetic requests or sanitized excerpts and require human review before storage or publication.