T09 · Insecure Skill Coding Practices
Error
- Location
references/mvp-implementation.py:55- Finding
Plaintext Persistence and Unconditional Admission of Sensitive Conversation Data
- Content
View full analysis
Vulnerability Details
File Location:
references/mvp-implementation.py, lines 55-80
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: HighComplete Code Snippet:
python (r'api.?key|token|secret|密码', 0.05, '凭证相关'), (r'\d{4}-\d{2}-\d{2}', 0.05, '时间信息'), ] for pattern, pts, reason in rules: if re.search(pattern, text, re.I): score += pts reasons.append(reason) if len(text.strip()) < 20: score *= 0.5 reasons.append('短文本惩罚') return round(score, 3), reasons def ingest(self, session_id, messages, source='chat'): """摄入消息，返回生成的 chunk IDs。""" c = self._conn.cursor() chunks = [] for i, msg in enumerate(messages): content = msg.get('content', '') cid = f"{session_id[:12]}-{msg.get('role','u')[:3]}-{i:03d}-{self._content_hash(content)}" score, reasons = self._fast_score(content) token_count = self._token_count(content) c.execute('''INSERT OR IGNORE INTO memory_chunks (id, session_id, content, content_hash, token_count, source, role, timestamp, score, is_admitted, score_reasons) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)''', (cid, session_id, content, self._content_hash(content), token_count, source, msg.get('role','user'), msg.get('timestamp', time.time()), score, json.dumps(reasons, ensure_ascii=False)))Technical Analysis
The scoring logic explicitly recognizes credential-related strings such as API keys, tokens, secrets, and passwords. Despite this recognition,
ingest()stores the complete raw message in thecontentcolumn. The SQL statement also assignsis_admitted=1to every message unconditionally, regardless of its score or sensitivity.The implementation provides no secret redaction, field-level ...[truncated 1437 chars]
- Remediation
View remediation
Remediation Suggestions
- Apply secret detection before persistence and reject or irreversibly redact recognized credentials.
- Replace secrets with a non-sensitive marker and retain only metadata needed for scoring.
- Do not admit every message automatically. Implement an admission policy based on sensitivity, provenance, message role, and score.
- Exclude tool output and assistant messages by default unless an explicit allowlist permits their storage.
- Encrypt sensitive fields or the entire database with keys managed separately from the database file.
- Create the database with owner-only permissions and document secure backup and deletion requirements.
- Add configurable retention periods, secure deletion, and per-session erasure.
- Require authorization for search and scope every retrieval operation to the requesting user or tenant.
- Add tests confirming that representative API keys, bearer tokens, passwords, and private keys are never stored or returned in plaintext.