T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:31
- Finding
- Overbroad Persistent Storage of Potentially Sensitive Session Information<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-36, 52-58, and 85 **Vulnerability Type**: Persistent plaintext storage without sensitivity filtering **Risk Level**: Medium ### Vulnerable Code ```markdown The agent writes critical details to SESSION-STATE.md BEFORE responding. Every decision, correction, and important detail is logged immediately. ```bash # Example: Log a decision echo "$(date) - Decision: Using model for generation" >> SESSION-STATE.md ``` ``` ```markdown SESSION-STATE.md survives context flush. Always read/write this file for: - Current project context - Pending decisions - Active tasks ``` ```markdown ALWAYS search memory before answering. ``` ### Technical Analysis The skill directs the agent to persist broadly defined information such as every important detail, correction, decision, and current project context. It does not define sensitivity filters, data minimization requirements, access controls, retention periods, or deletion procedures. The demonstrated shell command appends information directly to a plaintext workspace file. Consequently, credentials, access tokens, personal information, proprietary project details, or other sensitive conversation content could be retained if the agent considers them important. Because `SESSION-STATE.md` is explicitly designed to survive context flushes and be read during later interactions, its contents can cross session boundaries. Searching memory before every response further expands the circumstances in which stored information may be retrieved and incorporated into future output. ### Attack Path 1. A user supplies sensitive information during a normal interaction, such as a token, internal hostname, private project detail, or personal record. 2. The agent considers that information important to the current project or an associated decision. 3. Following the skill instructions, the agent appends the information to `SESSION-STATE.md` or another persistent memory ...[truncated 878 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make persistent memory an explicit opt-in feature and clearly disclose what information will be stored. 2. Replace broad instructions such as “every important detail” with an allowlist of permitted data categories. 3. Explicitly prohibit storage of passwords, API keys, session tokens, authentication cookies, private keys, personal data, and regulated information. 4. Apply secret detection and redaction before writing any value to persistent storage. 5. Store only concise derived summaries when persistence is necessary, rather than verbatim conversation content. 6. Enforce restrictive filesystem permissions on memory files and prevent access by unrelated users or processes. 7. Define retention periods, automatic expiration, and user-accessible inspection and deletion mechanisms. 8. Require confirmation before retrieving persistent information in a materially different session or context. 9. Avoid shell-based unstructured appends; use a validated storage routine with schema enforcement, sensitivity checks, and audit logging. ]]>