T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Persistent Plaintext Storage of Sensitive Relationship and Private-Session Data## Vulnerability Details **File Location**: `SKILL.md:16-24, 152-174` **Vulnerability Type**: Persistent plaintext storage of sensitive personal data without defined access, consent, retention, or deletion controls **Risk Level**: Medium ### Vulnerable Code Snippets ```markdown ## Setup: couple profiles On first use, create a `profiles/` directory in the agent workspace with: - `partner-a.md` and `partner-b.md` (individual patterns, triggers, parts, session notes) - `dynamic.md` (relationship cycle, attachment patterns, recurring loops) - `agreement.md` (living relationship agreement: boundaries, commitments, shared rules) - `golden.md` (success stories, golden concepts, and what works; see [references/golden-concepts.md](references/golden-concepts.md)) Load relevant profiles before starting any session. Treat profiles as hypotheses to refine; treat agreements as established ground rules. ``` ```markdown ## Session-end learning check Run at the end of every session: **1. Scan for new learnings:** - Anything contradict or refine existing profiles? - New pattern, trigger, exile, or protector visible? - History shared that explains a current pattern? - Dynamic behave differently than hypothesized? **2. Scan for skill gaps:** - Missing process or framing? - Question or situation the skill didn't handle well? **3. Update profiles** with dated, concrete entries. Note patterns and insights, not verbatim quotes. **4. Privacy between DMs:** - What one partner shares in DM stays between you and them - In the shared channel, only reference what was said there - Never say "X told me in private that..." - In memory files, note patterns, not private quotes **5. If a skill gap was found**, note it for future improvement. ``` ### Technical Analysis The skill requires the agent to create and continually update Markdown files containing individual triggers, psychological patterns, attachment dynamics ...[truncated 3068 chars]
- Remediation
- ## Remediation Suggestions 1. **Make persistence opt-in.** Default to ephemeral processing and obtain explicit consent from every person whose information will be recorded. 2. **Disclose the data model.** Explain which fields will be stored, where they will be stored, who can access them, and how long they will remain. 3. **Separate privacy domains.** Keep each partner's private records isolated from shared couple records. Never write private-DM-derived facts or inferences into jointly accessible files without explicit authorization. 4. **Enforce least privilege.** Restrict profile permissions to the minimum required identity and prevent unrelated agents, users, and workspaces from reading them. 5. **Encrypt sensitive records.** Use platform-supported encryption at rest and secure key management rather than relying on ordinary plaintext Markdown files. 6. **Minimize collection.** Store only information required for a user-approved coaching purpose. Avoid detailed histories, diagnostic-style labels, and speculative psychological inferences. 7. **Add retention and deletion controls.** Define an expiration period, support immediate deletion on request, and remove stale profiles automatically. 8. **Support review and correction.** Allow each partner to inspect, correct, and remove information attributed to them without exposing the other partner's private records. 9. **Verify identity and channel context.** Before loading a profile, ensure that the current user, couple, workspace, and private/shared channel match the record's authorization scope. 10. **Track provenance and sharing status.** Mark each entry as private, shared, or explicitly approved for sharing, and prevent information from moving between scopes automatically. 11. **Replace the current DM rule.** Explicitly prohibit storing private-session-derived facts and inferences in shared memory; removing quotations alone is not a sufficient privacy safeguard.