T09 · Insecure Skill Coding Practices
- Location
memory-template.md:10- Finding
Zendesk API Token Persisted in Plaintext Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
memory-template.md:10-13,memory-template.md:37-42,setup.md:48-53
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: HighVulnerable Code
memory-template.md:10-13:markdown ## Credentials subdomain: email: token:memory-template.md:37-42:markdown ## Credential Security - Store credentials in `~/zendesk/memory.md` or use environment variables - Environment variables: ZENDESK_SUBDOMAIN, ZENDESK_EMAIL, ZENDESK_TOKEN - Never echo credentials in responses - Never commit credentials to any reposetup.md:48-53:markdown In `~/zendesk/memory.md`: - Credentials (subdomain, email, token) - Common views they use - Preferred ticket templates - SLA targets if mentionedTechnical Analysis
The skill explicitly instructs the agent to save the Zendesk API token, account email, and tenant subdomain in
~/zendesk/memory.md. This is a plaintext Markdown file rather than a protected credential store. The instructions do not require restrictive directory or file permissions, encryption at rest, or exclusion from backup, synchronization, indexing, and diagnostic collection systems.A Zendesk API token is a reusable authentication secret. Its effective permissions correspond to those of the associated Zendesk account. Merely warning against committing the file does not protect it from local disclosure, backups, accidental attachment, cloud synchronization, malware, or another local account when filesystem permissions are permissive.
Attack Path
- The user supplies a valid Zendesk API token during skill setup.
- Following
setup.md, the agent writes the email, subdomain, and token to~/zendesk/memory.md. - The file is created without a documented requirement for mode
0600, directory mode0700, encryption, or secret-manager protection. - A local attacker, compromised process ...[truncated 1046 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the token field from the Markdown memory template.
- Never store authentication secrets in agent memory, ordinary configuration files, exported reports, or conversation history.
- Store the token in an operating-system keychain or established secret manager, such as macOS Keychain, Windows Credential Manager, Secret Service, or an organizational vault.
- If file-based secret storage is unavoidable, use a dedicated credentials file outside agent memory, create its parent directory with mode
0700, create the file with mode0600, and encrypt it at rest. - Store only a secret reference or credential identifier in
~/zendesk/memory.md. - Prefer a dedicated, least-privilege Zendesk integration account rather than a broadly privileged administrator account.
- Document token rotation and revocation procedures.
- If a token is disclosed through chat or existing memory files, revoke and rotate it rather than merely reminding the user.
- Ensure credential files are excluded from source control, cloud synchronization, indexing, diagnostics, logs, exports, and backups unless those systems provide suitable secret protection.