T09 · Insecure Skill Coding Practices
Warning
- Location
- memory-template.md:68
- Finding
- Persistent Memory Policy Permits Plaintext Secret Storage<![CDATA[ ## Vulnerability Details **File Location**: `memory-template.md`, line 68 **Vulnerability Type**: Conditional authorization of plaintext sensitive-data persistence **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Key Principles - Keep memory concise and decision-oriented. - Prefer natural language notes over rigid config dumps. - Update `last` after meaningful monitoring sessions. - Record misses and false positives to improve thresholds. - Never persist secrets unless explicitly requested by the user. ``` ### Technical Analysis The instruction prohibits secret persistence only when the user has not explicitly requested it. Consequently, the Skill may store passwords, access tokens, API keys, or other credentials in the Markdown-based persistent memory located under `~/trending-now/`. Although `setup.md` configures restrictive filesystem permissions, those permissions do not encrypt the stored data or protect it from processes operating as the same user, privileged local users, backups, synchronization tools, accidental sharing, or subsequent agents that can read the workspace. The Skill also defines no secret redaction, retention limit, secure deletion procedure, or integration with an operating-system credential store. Because persistent memory is intended to survive across sessions, storing a secret there extends its exposure beyond the request in which it was supplied. ### Attack Path 1. A user or untrusted instruction asks the Agent to remember an API token, password, or other credential. 2. The exception at `memory-template.md:68` authorizes the Agent to persist that secret when the request appears explicit. 3. The Agent writes the secret into `~/trending-now/memory.md` or another Markdown state file. 4. The plaintext value remains available across sessions. 5. A later Agent session, same-user process, backup system, synchronization service, accidental file disclosure, or local compromise reads the stored credential. 6. ...[truncated 660 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the conditional rule with an unconditional prohibition, for example: ```markdown - Never store passwords, access tokens, API keys, private keys, session cookies, or other secrets in Skill memory or Markdown state files, even when requested. ``` 2. Store only a non-sensitive reference identifying the required credential, such as its secret-manager entry name or environment-variable name. 3. Retrieve credentials at execution time through an operating-system keychain, dedicated secret manager, or platform-provided credential interface. 4. Prevent secrets from being copied into `memory.md`, `topics.md`, `runs.md`, `alerts.md`, logs, alerts, source links, and error messages. 5. Add redaction checks for common secret formats before writing persistent state. 6. Define retention and secure-deletion procedures for any sensitive metadata that legitimately must be retained. 7. Document that restrictive file permissions are defense in depth and are not a substitute for encrypted secret storage. ]]>