T09 · Insecure Skill Coding Practices
- Location
memory-template.md:60- Finding
Credentials May Be Persisted in Unprotected Markdown Memory
- Content
View full analysis
Vulnerability Details
File Location:
memory-template.md:60
Related Location:setup.md:38-46
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumVulnerable Code Snippets
memory-template.md:54-60:markdown ## Key Principles - Keep memory in natural language, not configuration-style key lists. - Store only information that improves future decisions. - Update `last` after each meaningful working session. - Preserve failed decisions and incidents to avoid repeating mistakes. - Never persist credentials unless user explicitly asks.setup.md:38-46:markdown ## Internal Notes Policy Maintain concise records in `memory.md`: - context and constraints that affect decisions - price and comparison outcomes that should be reused - seller and automation decisions with rationale - dispute incidents and resolution status Use data minimization. Never persist secrets unless user explicitly asks.Technical Analysis
The instructions permit credentials and other secrets to be persisted when a user explicitly requests it. The designated memory store is
~/mercado-libre/memory.md, which is described as a Markdown file. No encryption, restrictive filesystem permissions, access controls, redaction process, retention limit, or secret-manager integration is specified.User consent does not make plaintext secret storage secure. This policy also conflicts with
SKILL.md:23, which requires API tokens or keys to be stored in user-managed secret storage. An agent following the more specific memory instructions could therefore place authentication material directly in the Markdown memory file.Attack Path
- A user, or untrusted content presented as a user instruction, asks the agent to remember a Mercado Libre API token or another secret.
- The skill interprets explicit consent as authorization to persist the secret.
- The agent writes the secret into
~/mercado-libre/memory.md. - The plaintext value ...[truncated 798 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the consent-based exception with an unconditional prohibition against storing credentials, API tokens, passwords, MFA codes, payment data, session cookies, and recovery codes in memory files.
- Store secrets only in an operating-system keychain or dedicated secret manager with encryption at rest and access controls.
- Persist only non-sensitive secret references, such as a keychain entry name or secret identifier.
- Apply least-privilege API scopes and separate read-only credentials from credentials capable of marketplace write operations.
- Add automatic secret detection and redaction before writing any memory or automation log.
- Avoid recording authorization headers, complete API payloads containing secrets, or sensitive error output.
- Define credential rotation and revocation procedures for accidental persistence.
- Apply restrictive permissions to
~/mercado-libre/as defense in depth, while making clear that permissions do not replace proper secret storage. - Align
memory-template.mdandsetup.mdwith the secret-storage requirement inSKILL.md.
Recommended replacement:
markdown Never persist credentials or secrets in memory files, even when requested. Store authentication material only in user-managed secret storage and retain only a non-sensitive reference to the secret.