T09 · Insecure Skill Coding Practices
Error
- Location
- references/report-template.md:119
- Finding
- Plaintext Session Credentials Are Persisted and Embedded in Reports## Vulnerability Details **File Location**: `references/report-template.md:119-121`; related retention guidance in `references/post-delivery.md:10-14` **Vulnerability Type**: Plaintext sensitive-data storage and disclosure **Risk Level**: High ### Vulnerable Code `references/report-template.md:119-121`: ```markdown - Must use **BurpSuite raw HTTP request format** (not a curl command or JSON fragment) - **No redaction**: Preserve complete credentials (Cookie/Token/phone number) in the report because they are required for reproduction; redaction is deferred to delivery (encryption/internal transfer; see “Post-delivery”) - Mark key parameters with `【】`, such as `userId=【12345】` and `{"id":【5】}` ``` `references/post-delivery.md:10-14`: ```markdown Prompt the user: - [Warning] **Credential cleanup**: `pentest-data/{project-id}/sessions/account_*.json` contains plaintext tokens and cookies. Recommend cleanup or encrypted storage after delivery. Confirm that `pentest-data/` is in `.gitignore`. - [Warning] **Reports contain sensitive information**: `pentest-report/*.docx` contains complete requests and responses, including Authorization headers. Use encryption or internal transfer for delivery. ``` ### Technical Analysis The workflow deliberately retains active cookies and tokens in plaintext session files and requires complete, unredacted authentication material to be copied into persistent Markdown and DOCX reports. These artifacts can therefore contain reusable session cookies, bearer tokens, Authorization headers, personal information, and complete request and response bodies. A `.gitignore` rule only reduces accidental Git commits. It does not protect artifacts from other repository synchronization systems, backups, shared workspaces, local users, malware, report forwarding, or overly broad filesystem permissions. The post-delivery controls are advisory rather than enforced: the Skill prompts the user to clean or encry ...[truncated 2013 chars]
- Remediation
- ## Remediation Suggestions 1. Redact authentication values from all retained reports by default. Replace them with placeholders such as `Cookie: sessionid=[REDACTED]` while preserving request structure. 2. If exact credentials are indispensable, place them in a separate encrypted evidence package and require explicit user consent before generating it. 3. Store session material in an operating-system credential store or an encrypted temporary file rather than ordinary JSON files. 4. Create sensitive files with owner-only permissions, such as mode `0600`, and ensure containing directories are not accessible to other users. 5. Automatically remove session files and temporary deliverable files after report generation unless the user explicitly requests retention. 6. Revoke or invalidate test sessions at the end of the assessment where the target supports logout or token revocation. 7. Make encrypted delivery mandatory for unredacted artifacts rather than presenting it only as a recommendation. 8. Add automated checks that fail report generation when live Cookie, Authorization, bearer-token, or other secret patterns remain in a standard deliverable.