T09 · Insecure Skill Coding Practices
Warning
- Location
- setup.md:38
- Finding
- Persistent Plaintext Storage of Secrets and Sensitive Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:38-46` **Vulnerability Type**: Plaintext persistence of sensitive information **Risk Level**: Medium ### Vulnerable Code ```markdown ## What You Are Saving Internally Maintain concise notes in `memory.md`: - activation and collaboration preferences - system constraints and quality targets - decisions made, alternatives rejected, and open risks - recurring failure patterns from prior iterations Default to data minimization. Do not store secrets, credentials, legal identifiers, or private personal details unless explicitly requested. ``` ### Technical Analysis The Skill directs the agent to maintain persistent notes in `memory.md` while permitting secrets, credentials, legal identifiers, and private personal information to be stored when explicitly requested. The documented storage location is `~/search-engine/`, and no encryption, restrictive file permissions, secret-management integration, retention limit, redaction mechanism, or secure deletion process is defined. This exception creates an insecure plaintext secret-storage path. It also conflicts with the general data-minimization objective and the similar guidance in `memory-template.md:45`. An explicit user request—or an untrusted instruction presented as such—could cause sensitive material to be retained across sessions in a normal Markdown file. ### Attack Path 1. A user, malicious prompt, or untrusted task instruction asks the agent to remember a credential or sensitive identifier for future sessions. 2. The agent interprets the request as satisfying the documented “unless explicitly requested” exception. 3. The agent writes the sensitive value into `~/search-engine/memory.md`. 4. The value persists beyond the current session in plaintext. 5. A local process, another agent session, a backup system, or a person with access to the user's files reads or inadvertently discloses the stored value. This path does not independently grant e ...[truncated 851 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `unless explicitly requested` exception and categorically prohibit writing secrets, authentication material, legal identifiers, and private personal information to Markdown memory files. 2. Store only non-sensitive references, such as a secret-manager entry name or environment-variable identifier, never the secret value itself. 3. If sensitive persistence is operationally unavoidable, require an approved operating-system keychain or dedicated secret manager with encryption at rest, access controls, audit logging, and rotation support. 4. Define restrictive permissions for all persistent memory files and directories, such as owner-only access where supported. 5. Add explicit retention and secure-deletion requirements for stored context. 6. Redact sensitive values before recording session notes, experiment logs, incidents, or requirements. 7. Align `setup.md` with the stricter prohibition in `memory-template.md` so the Skill has one unambiguous policy. 8. Add validation before every memory write to detect and reject likely credentials, API keys, access tokens, passwords, and sensitive identifiers. ]]>