T09 · Insecure Skill Coding Practices
Warning
- Location
setup.md:11- Finding
Plaintext Persistence of Highly Sensitive Health Data Without Explicit Consent or Access-Control Requirements
- Content
View full analysis
Vulnerability Details
File Location:
setup.md:3,11-15; related storage schemas and export behavior appear inlog-template.md:3-23,32-70andprivacy.md:3-8,18-20
Vulnerability Type: Plaintext sensitive-data storage and insufficient local access controls
Risk Level: MediumVulnerable Code Snippets
setup.md:3markdown Read this on first use to load user data. Do not interview the user.setup.md:11-15markdown 1. Read `~/Clawic/data/period/config.yaml` if it exists. Apply its values. 2. For anything absent, use the defaults in the Configuration table of `SKILL.md` — do not ask. - `fertility_tracking: off`, `contraception: none`, `prediction_window: 6`, `temperature_unit: celsius`, `heads_up_days: 0`. 3. Read `~/Clawic/data/period/cycles.md` (the log) and `memory.md` (observed context). Absence is fine; start logging from what she shares now, and say once where the data lives and that export/deletion are always available (`privacy.md`). 4. If files exist at an old location (`~/period/` or `~/clawic/period/`), move them to `~/Clawic/data/period/` before reading.log-template.md:3-23markdown All files live in `~/Clawic/data/period/`. Three files, three jobs: `config.yaml` = declared, `cycles.md` = the data, `memory.md` = observed. ## cycles.md — the canonical log ```markdown # Cycle Log ## Cycle 14 start: 2026-03-27 # Day 1 = first day of full flow (never spotting) end: 2026-04-01 # last bleeding day length: 29 # this Day 1 to next Day 1; fill in when the next cycle starts flow: [d1 medium, d2 heavy, d3 medium, d4 light, d5 light, d6 spotting] # her scale symptoms: - d1 cramps moderate (ibuprofen helped) - d2 headache mild - d25 mood-low mild notes: travel days 8-12 fertility: # ONLY when fertility_tracking is not off - d13 opk positive - d15 bbt-shift confirmedtext ...[truncated 3064 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit persistence consent. Before the first write, clearly distinguish session-only processing from durable local storage. Default to session-only operation until the user affirmatively enables persistence.
- Enforce restrictive permissions. Create
~/Clawic/data/period/with mode0700and data files with mode0600. Verify and repair permissions on every existing file before reading or writing. - Use secure file operations. Reject symbolic links, avoid following links outside the designated directory, use atomic replacement, and validate canonical paths before migration, export, deletion, or update operations.
- Provide encryption at rest. Prefer an operating-system-protected secret or encrypted storage facility. If plaintext fallback is necessary, clearly disclose that limitation before enabling persistence.
- Minimize retained data. Allow users to disable
memory.md, omit selected sensitive fields, configure retention periods, and store only information required for requested features. - Harden exports. Show exports in-session by default. Before writing an export to disk, warn that it contains sensitive plaintext, require an explicit destination, and enforce owner-only permissions.
- Secure legacy migration. Validate ownership, permissions, and canonical paths for
~/period/and~/clawic/period/before moving data. Do not overwrite existing destination files without confirmation. - Document the threat model. Explain that “local” does not necessarily mean private from other accounts, malware, backups, search indexers, or synchronization software outside the Skill's control.