T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:89- Finding
Plaintext Persistence of Sensitive User Data Under Misleading Privacy Assurances
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 89, 107, 409-415, 477, 578-588, and 629
Vulnerability Type: Plaintext sensitive-data storage and unsupported privacy claims
Risk Level: MediumVulnerable Skill Instructions
The following is an English translation of the relevant instructions:
text Line 89: Privacy and security come first—all data only exists on the user's own device and will not be uploaded anywhere. Make the user feel 100% safe. Line 107: You can be completely assured about security: I will not store a single character from our conversation. I only organize the information into documents and give them to you. These materials only exist on your own device; nobody else can see them, and the platform cannot see them. Lines 409-415: I will generate six files: - SOUL.md — the AI's personality, character, and speaking style - USER.md — the AI's knowledge of the user, preferences, and needs - MEMORY.md — long-term memories and task progress from conversations - TOOLS.md — experience and lessons from using tools - SECRET.md — confidential information needed repeatedly - EMAIL_RULES.md — behavioral and communication rules Line 477: Based on the user's answers, first-stage information, and reasonable inference, generate six files. Lines 578-588: # SECRET.md · Confidential Information ## Sensitive Information - [Information type]: [Usage context and precautions] ## Security Reminder - This information is only stored locally and will not be uploaded anywhere. - Remove sensitive content before sharing the document. Line 629: These files only exist on your own device, so you can be completely assured.Technical Analysis
The Skill makes absolute claims that conversation content is not stored and cannot be seen by the platform, while subsequently directing the Agent to persist user information in several Markdown files. The contradiction is e ...[truncated 3233 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove unsupported guarantees
- Replace claims such as “I will not store a single character,” “the platform cannot see it,” and “100% safe” with an accurate disclosure of what is collected, where it is written, and who may be able to access it.
- Do not claim local-only storage unless the implementation verifies and enforces that property.
-
Eliminate the plaintext secret file
- Remove
SECRET.mdfrom the workflow. - Explicitly instruct users not to provide passwords, API keys, access tokens, private keys, financial identifiers, medical information, or other regulated data.
- Where sensitive persistence is essential, use an approved encrypted secret store rather than Markdown.
- Remove
-
Require informed consent
- Before writing files, display the proposed filenames, destination, information categories, retention behavior, and access implications.
- Require explicit opt-in consent and allow users to exclude individual fields.
- Present a redacted preview of the exact content before persistence.
-
Minimize and classify collected data
- Collect only fields necessary for the stated personalization purpose.
- Separate user-confirmed facts from Agent inferences.
- Do not persist inferred sensitive attributes without explicit confirmation.
- Apply allowlists for acceptable fields and automatic detection or redaction for likely credentials and secrets.
-
Protect persisted data
- Use a dedicated private storage directory with least-privilege filesystem permissions.
- Encrypt sensitive profiles at rest when supported.
- Prevent generated files from being placed in source-controlled or publicly shared locations by default.
- Warn users about backup, synchronization, repository, and document-sharing exposure.
-
Implement lifecycle controls
- Define a short retention period appropriate to the feature.
- Provide clear comm ...[truncated 442 chars]
-