T09 · Insecure Skill Coding Practices
Warning
- Location
- setup.md:61
- Finding
- Plaintext Persistent Storage of Highly Sensitive User Data## Vulnerability Details **File Location**: `setup.md`, lines 61–68; related instruction in `memory-template.md`, lines 50–53 **Vulnerability Type**: Plaintext sensitive-data storage caused by unsafe configuration guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Keep `~/florida/memory.md` lightweight and useful: - activation preference for Florida topics - current mode and target region - major deadlines, seasonal patterns, and open loops - persistent family, school, housing, insurance, and storm constraints - which official portals or local agencies already matter for this user Do not store credentials, account numbers, SSNs, Medicare IDs, full street addresses, or payment details unless the user explicitly asks for that behavior. ``` The related instruction in `memory-template.md` states: ```markdown - Save only details that will materially improve the next Florida answer. - Keep the default memory coarse. Do not store full street addresses or sensitive identifiers unless the user explicitly asks for saved continuity at that level. ``` ### Technical Analysis The Skill permits credentials, account numbers, Social Security numbers, Medicare identifiers, full street addresses, payment details, and other sensitive identifiers to be saved when the user explicitly requests persistence. The designated storage location is a Markdown file at `~/florida/memory.md`. The instructions provide no requirement for encryption at rest, restrictive file permissions, data-field allowlisting, redaction, retention limits, secure deletion, or protection from backups and synchronization services. Consent does not make plaintext secret storage safe; an agent should refuse to persist authentication secrets, payment information, and high-impact identity identifiers in an ordinary text file. This behavior also conflicts with `SKILL.md`, lines 124–126, which makes the unconditional claim that the Skill does not store credentials, SSNs, Medicare numbers, or ...[truncated 1801 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both “unless the user explicitly asks” exceptions. 2. Unconditionally prohibit persistent storage of: - Passwords, access tokens, API keys, recovery codes, and other credentials - SSNs and government-issued identity numbers - Medicare and other healthcare identifiers - Bank, card, and payment details - Full street addresses unless indispensable and protected by an approved secure store 3. Replace the denylist with a strict allowlist of coarse, low-sensitivity preferences, such as region, general timeline, and non-sensitive planning constraints. 4. Redact sensitive values before writing memory and instruct the agent to store references such as “document collected” rather than document contents. 5. If local persistence remains supported, require restrictive file permissions, atomic writes, retention limits, user-visible review, and a deletion workflow. 6. Do not place secrets in Markdown. Where sensitive persistence is genuinely required, use an operating-system credential manager or another approved encrypted secret store. 7. Make `setup.md`, `memory-template.md`, and the privacy claims in `SKILL.md` consistent. 8. Add tests or policy checks that reject attempted persistence of prohibited sensitive-data classes even when a user requests it.