T09 · Insecure Skill Coding Practices
- Location
references/EVOLUTION_GUIDE_EN.md:27- Finding
Unrestricted Environment Variable Collection May Expose Secrets
- Content
View full analysis
Vulnerability Details
File Location:
references/EVOLUTION_GUIDE_EN.md, lines 27-30
Vulnerability Type: Excessive collection of sensitive environment data
Risk Level: MediumVulnerable Code Snippet:
markdown ### 3. Dynamic Context Injection **Core Logic**: Force synchronization of "System Snapshots" before task initiation. * **Snapshot Mechanism**: Automatically fetch the current Git branch, directory structure, and environment variables. * **Precision Backtracking**: Optimize index for history to ensure suggestions are based on the most current state of the system, not fuzzy memory.The equivalent instruction also appears in
references/EVOLUTION_GUIDE_CN.md, lines 27-30.Technical Analysis
The guide directs the agent to automatically retrieve all environment variables when constructing a system snapshot. Environment variables frequently contain API keys, access tokens, cloud credentials, database connection strings, proxy credentials, and other sensitive values.
Collecting the complete environment is not necessary for the Skill's declared coordinator-upgrade functionality. Compatibility checks generally require only repository state, policy-file availability, and verification capabilities. Consequently, unrestricted environment-variable access exceeds the minimum data access needed for the task.
Once collected, sensitive values may enter model context, conversation history, diagnostic output, execution plans, logs, or delegated sub-agent sessions. Although the pre-scan described a possible network-sensitive pattern, the audited files contain no network request, remote endpoint, upload command, or other evidence that the collected information is intentionally transmitted externally.
Attack Path
- A user invokes the Skill to assess or apply a coordinator-mode upgrade.
- The agent follows the dynamic snapshot instruction before beginning the task.
- The agent enumerates the ...[truncated 983 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to collect all environment variables.
- Limit snapshots to information required for compatibility checks, such as the current Git branch, repository status, and a depth-limited directory structure.
- If environment configuration must be inspected, use an explicit allowlist of non-sensitive variable names.
- Collect variable names without values whenever possible.
- Require explicit user approval before accessing any environment-variable value.
- Deny or redact variables whose names match secret indicators such as
TOKEN,SECRET,PASSWORD,KEY,CREDENTIAL,AUTH, andCOOKIE. - Prevent environment values from being included in model prompts, logs, generated plans, error reports, or sub-agent messages.
- Apply the same correction to the equivalent instruction in
references/EVOLUTION_GUIDE_CN.md, lines 27-30. - Document that snapshot collection must continue to respect the existing permission pipeline and least-privilege policy.