T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:32
- Finding
- Plaintext Persistence of Sensitive AirTag Location and Behavioral Data## Vulnerability Details **File Location**: `SKILL.md:32-40`, `memory-template.md:3-26`, `setup.md:41-50`, and `recovery-playbook.md:49-53` **Vulnerability Type**: Plaintext storage of sensitive location, ownership, and behavioral information **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:32-40`: ```markdown Memory lives in `~/airtag/`. See `memory-template.md` for structure and status fields. ```text ~/airtag/ |-- memory.md # Status, active connector mode, and operating boundaries |-- items.md # AirTag inventory, aliases, and ownership context |-- incidents.md # Lost-item timelines, actions taken, and outcomes |-- maintenance.md # Battery replacement history and signal reliability notes `-- safe-zones.md # Frequent locations and expected left-behind behavior ``` ``` `memory-template.md:3-26`: ```markdown Create `~/airtag/memory.md` with this structure: ```markdown # AirTag Memory ## Status status: ongoing version: 1.0.0 last: YYYY-MM-DD integration: pending | done | declined ## Context <!-- Stable environment details, in natural language --> <!-- Example: User carries two AirTags (keys, backpack) and often commutes by train --> ## Notes <!-- Operational observations and repeated patterns --> <!-- Example: Precision Finding fails indoors on office floor 12; map ring still works --> ## Active Incidents <!-- Open incidents with timestamp, item, last-known location, and next action --> --- *Updated: YYYY-MM-DD* ``` ``` `setup.md:41-50`: ```markdown ## What to Save Internally Store these categories when user-approved: - Activation boundaries and proactive/ask-only preference - Chosen default connector mode and constraints - Stable inventory facts (items, aliases, ownership context) - Repeated failures and validated fixes - Safety preferences for unknown-AirTag notifications Keep records concise and operation ...[truncated 3191 chars]
- Remediation
- ## Remediation Suggestions 1. Default to ephemeral processing and make persistence explicitly opt-in for each category of sensitive information. 2. Create `~/airtag/` with owner-only permissions such as mode `0700`, and create stored files with mode `0600`. 3. Store precise locations in operating-system-protected encrypted storage rather than plaintext Markdown. 4. Record coarse descriptions or redacted location identifiers unless exact coordinates are essential to an active recovery. 5. Avoid retaining safe zones, movement history, and ownership context unless the user separately confirms that each category is necessary. 6. Establish short retention periods for active incidents and automatically remove expired location records. 7. Provide a user-visible command to review, export, redact, and securely delete all saved AirTag data. 8. Warn users when the storage directory may be included in cloud synchronization or backups. 9. Document that connector session material, authentication tokens, shared-link secrets, and raw credentials must never be written to these files. 10. Preserve the existing requirement for explicit confirmation before every connector action, location pull, or local write.