T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:34
- Finding
- Automatic Plaintext Persistence of Sensitive Financial and Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34`, `SKILL.md:88`, `SKILL.md:148`, and `memory-template.md:23` **Vulnerability Type**: Automatic storage of sensitive information in unencrypted local files **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:34`: ```markdown **Write before the session ends** whenever it produced something durable: a rate, balance or account discovered or changed; a payoff order agreed; a goal with a date; a budget or savings rate; a net-worth reading; a decision taken and why; a cover level or deductible; a review that ran; or something the user will want to read again — a payoff plan, an investment policy, a rent-versus-buy analysis, a coverage map, a job-loss playbook. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write. ``` `SKILL.md:88`: ```markdown 9. **The plan lives in a file, not in the reply.** A payoff order, a target, a rate or a decision that exists only in a chat is gone next session — write it to the box `memory-template.md` names, in the same turn it is agreed. ``` `SKILL.md:148`: ```markdown - Persistence: did this session change a rate, balance, account, payoff order, goal, cover level or decision? Then it is written to its box before the answer ends — `memory-template.md` says which one. ``` `memory-template.md:23`: ```markdown No permission needed; every write is announced in one line that names the file. Writes and deletions stay inside the paths declared in this skill's `configPaths`. A deletion is named in that same line, and in a shared box only rows this skill itself wrote are ever updated or removed. ``` The stored data model includes account institutions, balances, debts, credit limits, income, spending, net worth, employment information, contacts, fraud history, and financial decisions. Representative plaintext records are defined in `memory-template.md:161-176` and `memory-template.md:201-206`. ### Tec ...[truncated 3072 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to session-only processing and require explicit opt-in before creating persistent records. 2. Present the exact fields and destination file before writing sensitive data. 3. Add configuration controls such as: - `persistence_enabled` - `allowed_persistent_fields` - `retention_days` - `shared_storage_enabled` 4. Minimize retained data. Prefer aggregates or user-selected aliases over account-level records. 5. Encrypt sensitive financial files at rest using an operating-system key store or a user-controlled encryption key. 6. Create files with restrictive permissions and verify that directories are inaccessible to unrelated local users. 7. Avoid writing sensitive information to shared boxes unless the user separately authorizes cross-Skill access. 8. Provide commands or documented procedures to review, export, redact, and delete all retained information. 9. Introduce expiration and periodic cleanup for stale balances, contacts, incidents, and decision records. 10. Continue stripping credentials, but treat balances, income, net worth, fraud history, and contact information as sensitive data requiring protection rather than as unrestricted plaintext. ]]>