T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- Uncontrolled Persistent Storage of Sensitive Personal Profiles## Vulnerability Details **File Location**: `SKILL.md:20-25`, `SKILL.md:77-120`, `memory.md:12-52`, and `memory.md:80-96` **Vulnerability Type**: Persistent plaintext storage of sensitive personal and behavioral data without adequate privacy controls **Risk Level**: Medium ### Complete Vulnerable Code Snippets From `SKILL.md:20-25`: ```markdown ## Core Behavior - Create `~/friend/` as workspace for deep context - Keep critical info in this file (always in context) - Store detailed history in workspace files - Update sections below as you learn about them ``` From `SKILL.md:77-120`: ```markdown ## Memory Storage Profile data persists in `~/friend/memory.md` (survives skill updates). **On first load:** Create `~/friend/memory.md` if it doesn't exist with this format: ```markdown # Friend Memory ## Life Now <!-- Current situation: job, relationship, living, major projects --> ## People <!-- Key names + relationship. Format: "Name (relation): context" --> ## Values <!-- What matters deeply. What they care about. --> ## Energy <!-- What energizes vs drains them --> ## Patterns <!-- Communication patterns, stress signals, preferences --> ## Open Loops <!-- Things to follow up on. Format: "topic — last mention date" --> ``` **Usage:** Read `~/friend/memory.md` at session start. Update as you learn about them. --- ## Folder Structure ``` ~/friend/ ├── memory.md # their profile (persistent) ├── context.md # detailed life context ├── people.md # everyone they mention ├── history.md # interaction log └── notes.md # observations, patterns ``` Update workspace files for deep storage. ``` From `memory.md:12-52`: ```markdown ## What to Track ### Current Life Context - What's happening right now (job situation, relationship status, living situation) - Major ongoing projects or challenges - What's consuming their mental energy ### Important People - Key relationships: family, partner, close friends, colleagues - Dyn ...[truncated 4171 chars]
- Remediation
- ## Remediation Suggestions 1. **Require explicit opt-in** - Do not create or update persistent memory until the user has knowingly enabled it. - Explain what categories will be stored, where they will be stored, and how long they will remain. 2. **Default to transient processing** - Keep conversational information in session context unless the user explicitly asks for a fact to be remembered. - Do not maintain a comprehensive interaction log by default. 3. **Apply data minimization** - Replace instructions such as “everyone they mention” and “detailed history” with narrowly scoped storage. - Avoid recording third-party information, emotional inferences, triggers, and sensitive behavioral profiles unless strictly necessary and explicitly approved. - Store user-provided facts rather than inferred psychological observations. 4. **Add retention and deletion controls** - Define an expiration period for stored records. - Provide commands to list, correct, selectively forget, export, and delete all retained information. - Honor fresh-start requests by securely removing obsolete data rather than merely ceasing to reference it. 5. **Protect files** - Create the directory and files with owner-only permissions, such as directory mode `0700` and file mode `0600`. - Avoid following symbolic links when creating or updating memory files. - Use atomic writes and validate that the resolved path remains inside the intended workspace. - Consider encryption at rest where the execution environment provides secure key management. 6. **Separate sensitive categories** - Do not place detailed history, personal profiles, and inferred patterns into one broadly reusable context. - Mark sensitive records and prevent their use outside the conversation purpose for which consent was given. 7. **Document the privacy boundary** - Clearly state that local administrators, same-account processes, backups, or synchronization systems may access pl ...[truncated 103 chars]