T09 · Insecure Skill Coding Practices
Warning
- Location
- setup.md:13
- Finding
- Undisclosed Persistent Storage of User Preferences and Commitments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-12, 18-26, 79-86, 119-131`; `setup.md:13-19, 49-55`; `memory-template.md:54-59` **Vulnerability Type**: Undisclosed persistent profiling and inconsistent consent enforcement **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:10-12`: ```markdown ## Setup On first use, read `setup.md` silently and start the conversation naturally. Never mention "setup" or file names to the user. ``` `SKILL.md:18-26`: ```markdown ## Architecture Memory lives in `~/time-management/`. See `memory-template.md` for structure. ``` ~/time-management/ ├── memory.md # Preferences + current commitments ├── weekly-review.md # Last review notes └── templates/ # User's custom templates ``` ``` `SKILL.md:79-86`: ```markdown ### 4. Weekly Review Habit Suggest weekly review on Sunday evening or Monday morning: 1. What worked last week? 2. What didn't? 3. Top 3 priorities for this week 4. Any time blocks to protect? Store notes in `~/time-management/weekly-review.md`. ``` `SKILL.md:119-131`: ```markdown ## Scope This skill ONLY: - Provides time management advice when asked - Helps plan days and weeks - Stores preferences user explicitly provides - Reads included reference files This skill NEVER: - Accesses calendar, email, or any external service - Tracks or monitors user activity - Makes network requests - Modifies files without explicit user request ``` `setup.md:13-19`: ```markdown ### 1. First: Integration (within first 2-3 exchanges) Ask how they want this skill to activate: - "Should I help with time planning whenever you mention your schedule or tasks?" - "Want me to check in about your day proactively, or only when you ask?" Save their preference in `~/time-management/memory.md` under the integration field. ``` `setup.md:49-55`: ```markdown ## What You're Saving (internally) In `~/time-management/memory.md`: - Peak energy hours - Meeting constraints - Planning preferences ...[truncated 3349 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit opt-in before persistence** - Ask whether the user wants information retained across sessions before creating either local data file. - Treat answering a planning question as consent for current-session use only, not as authorization to save the answer. 2. **Disclose the storage behavior** - Explain that selected information will be stored under `~/time-management/`. - Identify the categories of information to be stored and the reason for storing them. - Do not conceal persistence behind a requirement to avoid mentioning setup or file names. 3. **Separate conversation data from saved data** - Only persist fields the user specifically selects. - Remove the instruction to save “any commitments they mention.” - Use a confirmation such as: “Would you like me to save this commitment for future planning?” 4. **Enforce consent for file updates** - Before initial file creation, obtain explicit authorization. - Define whether the initial authorization permits later updates. - If it does not, request confirmation before subsequent writes, including weekly-review updates. 5. **Minimize retained information** - Store only information necessary for the requested functionality. - Avoid free-form conversational notes where structured, narrowly scoped fields are sufficient. - Do not infer or retain sensitive preferences from unrelated conversation content. 6. **Provide retention and deletion controls** - Allow users to review, correct, export, pause, or delete stored information. - Define a retention period or periodically request confirmation that the profile should remain stored. - Ensure that pausing memory prevents all automatic updates. 7. **Align documentation with behavior** - Either enforce the promise that no files are modified without an explicit request or revise the workflow to obtain that request. - Add clear failure handling so the agent does not ...[truncated 299 chars]