T09 · Insecure Skill Coding Practices
Warning
- Location
- memory-template.md:60
- Finding
- Credentials May Be Persisted in Unprotected Markdown Memory## Vulnerability Details **File Location**: `memory-template.md:60` **Related Location**: `setup.md:38-46` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code Snippets `memory-template.md:54-60`: ```markdown ## Key Principles - Keep memory in natural language, not configuration-style key lists. - Store only information that improves future decisions. - Update `last` after each meaningful working session. - Preserve failed decisions and incidents to avoid repeating mistakes. - Never persist credentials unless user explicitly asks. ``` `setup.md:38-46`: ```markdown ## Internal Notes Policy Maintain concise records in `memory.md`: - context and constraints that affect decisions - price and comparison outcomes that should be reused - seller and automation decisions with rationale - dispute incidents and resolution status Use data minimization. Never persist secrets unless user explicitly asks. ``` ### Technical Analysis The instructions permit credentials and other secrets to be persisted when a user explicitly requests it. The designated memory store is `~/mercado-libre/memory.md`, which is described as a Markdown file. No encryption, restrictive filesystem permissions, access controls, redaction process, retention limit, or secret-manager integration is specified. User consent does not make plaintext secret storage secure. This policy also conflicts with `SKILL.md:23`, which requires API tokens or keys to be stored in user-managed secret storage. An agent following the more specific memory instructions could therefore place authentication material directly in the Markdown memory file. ### Attack Path 1. A user, or untrusted content presented as a user instruction, asks the agent to remember a Mercado Libre API token or another secret. 2. The skill interprets explicit consent as authorization to persist the secret. 3. The agent writes the secret into `~/mercado-libre/memory.md`. 4. The plaintext value ...[truncated 798 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the consent-based exception with an unconditional prohibition against storing credentials, API tokens, passwords, MFA codes, payment data, session cookies, and recovery codes in memory files. 2. Store secrets only in an operating-system keychain or dedicated secret manager with encryption at rest and access controls. 3. Persist only non-sensitive secret references, such as a keychain entry name or secret identifier. 4. Apply least-privilege API scopes and separate read-only credentials from credentials capable of marketplace write operations. 5. Add automatic secret detection and redaction before writing any memory or automation log. 6. Avoid recording authorization headers, complete API payloads containing secrets, or sensitive error output. 7. Define credential rotation and revocation procedures for accidental persistence. 8. Apply restrictive permissions to `~/mercado-libre/` as defense in depth, while making clear that permissions do not replace proper secret storage. 9. Align `memory-template.md` and `setup.md` with the secret-storage requirement in `SKILL.md`. Recommended replacement: ```markdown Never persist credentials or secrets in memory files, even when requested. Store authentication material only in user-managed secret storage and retain only a non-sensitive reference to the secret. ```