T09 · Insecure Skill Coding Practices
Note
- Location
references/examples.md:14- Finding
Plaintext Personal and Local Environment Identifiers in Published Documentation
- Content
View full analysis
"Are we checking your personal Gmail (jamesxu81@gmail.com) or work email?" ``` `references/examples.md:21`: ```text Account: jamesxu81@gmail.com ``` `references/examples.md:55`: ```text File: /Users/luckbot/Projects/mission-control/src/auth/validate.js ``` ### Technical Analysis The distributed documentation embeds a concrete email address, geographic timezone indicator, local operating-system username, and workstation project path. Reusable examples should use clearly fictional values or placeholders rather than identifiers that appear to refer to an actual person or development environment. The disclosed values do not constitute executable code or authentication credentials, and the reviewed CLI does not transmit them. Nevertheless, publishing them provides reconnaissance information that can correlate an email identity with a probable timezone, local username, operating system, and internal project naming. An attacker does not need to invoke the Skill to exploit the disclosure. Merely obtaining and inspecting the package is sufficient. ### Attack Path 1. An attacker downloads or otherwise obtains the published Skill package. 2. The attacker searches its Markdown files for email addresses, absolute filesystem paths, account names, and environment details. 3. The attacker extracts `jamesxu81@gmail.com`, the `NZ` or `Pacific/Auckland` timezone context, the local username `luckbot`, and the ...[truncated 863 chars]- Remediation
View remediation