T09 · Insecure Skill Coding Practices
Warning
- Location
- memory-template.md:9
- Finding
- Persistent Plaintext Storage of Personal Travel and Booking Data<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:5-11, 23-38`; `memory-template.md:9-42` **Vulnerability Type**: Plaintext storage of personal and booking information without explicit consent, access-control hardening, or retention controls **Risk Level**: Medium ### Vulnerable Code `setup.md:5-11`: ```markdown ## 1. Create Memory ```bash mkdir -p ~/new-zealand ``` Create `~/new-zealand/memory.md` from `memory-template.md`. ``` `setup.md:23-38`: ```markdown ## 3. Save the Important Friction Points Track: - arrival city and departure city - ferry needs - tolerance for long drives - weather-sensitive priorities - already-booked anchors ## 4. Returning Users If `~/new-zealand/memory.md` exists: 1. Read it silently 2. Reuse known route and style preferences 3. Ask what changed since last plan 4. Update memory with new constraints ``` `memory-template.md:9-27, 39-42`: ```markdown ## Trip Details - **Dates:** - **Duration:** - **Island focus:** [North / South / Both] - **Entry/exit cities:** - **Travelers:** [solo / couple / family / group] - **Kids:** [yes (ages) / no] ## Preferences - **Travel style:** [foodie / outdoors / road-trip / family / luxury / mixed] - **Budget:** [budget / mid-range / luxury] - **Dietary:** [none / vegetarian / vegan / gluten-free / other] - **Mobility:** [full / limited / wheelchair] - **Transport:** [rental car / campervan / domestic flights / mixed] ## Constraints - **Drive tolerance:** [short only / moderate / long days OK] - **Weather sensitivity:** - **Hiking level:** [light walks / day hikes / serious tramping] - **Already booked:** - **Must-do items:** ## Bookings Made | What | Where | Date | Confirmation | |------|-------|------|--------------| | | | | | ``` ### Technical Analysis The skill creates a persistent directory and memory file under the user's home directory, then records trip dates, entry and exit locations, children's ages, mobility limitations, dietary requirements, existing bookings, a ...[truncated 2629 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit persistence consent** - Ask whether the user wants trip details saved before creating or updating `memory.md`. - Provide a session-only mode that does not write to disk. 2. **Minimize retained data** - Do not store children's exact ages by default. - Replace mobility and dietary details with a minimal planning flag unless the user explicitly requests persistence. - Store generalized travel windows rather than exact dates where exact values are unnecessary. 3. **Exclude sensitive reservation values** - Remove the `Confirmation` column from the default template. - If booking tracking is needed, store a non-sensitive label such as `booked: yes` rather than the complete confirmation code. - Warn users not to store payment details, passport information, account credentials, ticket barcodes, or authentication codes. 4. **Enforce restrictive filesystem permissions** - Create the directory with permissions limited to its owner, for example: ```bash install -d -m 700 "$HOME/new-zealand" ``` - Create or harden the memory file with owner-only permissions: ```bash touch "$HOME/new-zealand/memory.md" chmod 600 "$HOME/new-zealand/memory.md" ``` - Avoid relying solely on the environment's inherited `umask`. 5. **Add retention and deletion controls** - Document how users can inspect, edit, clear, or delete stored memory. - Offer automatic deletion after the trip or after a defined inactivity period. - Ask whether completed-trip details should be retained before moving the status to `completed`. 6. **Make reuse transparent** - Inform the user when saved memory is loaded rather than requiring it to be read silently. - Summarize which stored fields will be reused and allow the user to exclude individual fields. 7. **Protect writes** - Use atomic file replacement with restrictive permissions to reduce accidental disclosure or corruption. - Validate that the target ...[truncated 93 chars]