T09 · Insecure Skill Coding Practices
Error
- Location
- secrets.md:67
- Finding
- Secret-scanning commands can disclose credential values into agent output and session transcripts## Vulnerability Details **File Location**: `secrets.md`, lines 67–70 **Vulnerability Type**: Sensitive information exposure through unsafe secret-scanning output **Risk Level**: High ### Complete Code Snippet ```markdown ## Git History - Present in the current tree: `git grep -n -I -e '<pattern>'`. - Present in any past commit: `git log -p --all -S'<pattern>' --pickaxe-regex` — `-S` finds commits where the count of matches changed, which is exactly "added or removed". - When it was added, for the access-log window: `git log --diff-filter=A --format='%H %ad' -- <path>`. - Whether it left the machine: `git remote -v`, then whether the containing commit is an ancestor of any remote branch (`git branch -r --contains <sha>`). ``` This behavior conflicts with the security guarantee in `SKILL.md`, line 222: ```markdown **Credentials:** this skill searches for credentials in order to report their location. It does NOT read, print, copy, transmit, or store any credential value, does NOT write a credential into `~/Clawic/data/`, and never rotates or revokes anything on the user's behalf without an explicit instruction. Findings carry file, line, and kind only. ``` ### Technical Analysis The recommended Git commands are not output-safe for secret detection: - `git grep -n` prints the complete matching source line. If the search pattern matches a credential prefix, the output can contain the full usable credential. - `git log -p` prints complete historical patches, including lines that added or removed credentials. - Report-level instructions not to quote secrets do not prevent the underlying tool output from entering the model context, session transcript, command log, or other diagnostic storage. - The issue therefore occurs before final-report redaction and directly contradicts the Skill's assertion that credential values are never read or printed. The Skill does not instruct the agent to transm ...[truncated 1523 chars]
- Remediation
- ## Remediation Suggestions 1. Replace line- and patch-producing searches with a local redacting scanner that emits only: - relative file path; - line number; - credential type or prefix family; - commit identifier when relevant; - a non-sensitive fingerprint if correlation is necessary. 2. Do not return matched substrings, complete lines, surrounding context, or patches to the model. 3. For current-tree scanning, use a wrapper that performs matching locally and converts each hit to sanitized metadata before writing to standard output. 4. For history scanning, inspect commit blobs or diffs through the same redaction layer; never expose raw `git log -p` output. 5. Ensure the wrapper also sanitizes standard error, exceptions, debug logs, and temporary files. 6. Add automated tests containing synthetic credentials and verify that no complete value or reconstructable fragment appears in tool output, transcripts, reports, logs, or audit memory. 7. Document the safe scanner as the only permitted credential-content inspection mechanism and remove the unsafe raw Git command examples. 8. Continue requiring rotation before repository or history cleanup when a genuine credential is found.