T09 · Insecure Skill Coding Practices
Warning
- Location
AGENTS.md:23- Finding
Overbroad Persistent Collection and Reloading of Conversation History
- Content
View full analysis
Vulnerability Details
File Location:
AGENTS.md, lines 23-53
Vulnerability Type: Persistent storage and repeated loading of potentially sensitive conversation data
Risk Level: MediumRelevant source excerpt, faithfully translated into English:
markdown **The following must be read before work every day:** 1. **Previous business day's chat history** 2. **Recent week's work logs** (`memory/YYYY-MM-DD.md`) 3. **Recent month's weekly logs** (for example, `memory/week-XX.md`) 4. **Recent quarter's monthly logs** (for example, `memory/month-XX.md`) **Logging rules:** - **Daily log**: Automatically summarize and write to `memory/YYYY-MM-DD.md` at the end of the day - **Weekly log**: Automatically summarize and write to `memory/week-XX.md` at the end of the week - **Monthly log**: Automatically summarize and write to `memory/month-XX.md` at the end of the month - **Backfill mechanism**: If not written in time, write it at the start of the next business day - **Chat history**: Automatically save every 10 minutes - **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened - **Long-term:** `MEMORY.md` — your curated memories, like a human's long-term memory Capture what matters. Decisions, context, things to remember. Skip the secrets unless asked to keep them. - **ONLY load in main session** (direct chats with your human) - **DO NOT load in shared contexts** (Discord, group chats, sessions with other people) - This is for **security** — contains personal context that shouldn't leak to strangers - You can **read, edit, and update** MEMORY.md freely in main sessionsTechnical Analysis
The generated agent template mandates collection of chat history and multiple layers of daily, weekly, monthly, and long-term memory. Chat records are automatically saved every ten minutes and subsequently reloaded in later sessions.
No explicit opt-in mechanism, ...[truncated 1984 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable raw conversation logging by default and require explicit, informed user opt-in.
- Store minimal structured summaries instead of complete chat transcripts.
- Apply automatic redaction for passwords, API keys, access tokens, private keys, personal identifiers, and financial data before writing.
- Define short retention periods and automatically delete expired logs.
- Restrict memory-file permissions to the specific agent that owns them.
- Encrypt sensitive memory at rest where supported.
- Mark all memory content as untrusted data and explicitly prohibit it from overriding system, safety, permission, or current-user instructions.
- Require confirmation before loading unusually broad historical records.
- Maintain an auditable index showing what was stored, why it was stored, and when it will be deleted.