T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:51
- Finding
- Unfiltered Plaintext Storage of Conversation Data## Vulnerability Details **File Location**: `SKILL.md:51-64` (behavior is also specified in `SKILL.md:5-7`, `SKILL.md:91-94`, and `README.md:5`, `README.md:56-61`) **Vulnerability Type**: Plaintext storage of potentially sensitive conversation data **Risk Level**: Medium ### Vulnerable Code ```javascript // Format log entry const userMsg = /* get user message */; const assistantMsg = /* get assistant reply */; let logEntry = `\n[${timeStr}]\n`; if (userMsg) { logEntry += `User: ${userMsg}\n`; } if (assistantMsg) { logEntry += `Assistant: ${assistantMsg}\n`; } // Append to file fs.appendFileSync(logFile, logEntry); ``` ### Technical Analysis The skill instructs the agent to append complete user messages and assistant replies verbatim to a predictable daily Markdown file. No controls are provided for user consent, sensitive-data detection, credential redaction, file permissions, encryption, retention, or secure deletion. Conversation content can contain passwords, API tokens, personal information, proprietary data, or secrets returned by tools. Writing this content directly to the workspace creates a persistent plaintext copy that may be available to other local users, processes, backup systems, synchronization services, or anyone with access to a shared workspace. The Markdown log format also fails to escape or structurally encode untrusted multiline messages. A crafted message can inject apparent timestamps, `User:` fields, or `Assistant:` fields, allowing an attacker to forge misleading log records and undermine the integrity of an audit trail. ### Attack Path 1. A user, external prompt, document, or tool response introduces sensitive information or crafted multiline log syntax into a conversation. 2. The agent follows the skill instructions and assigns the untrusted content directly to `userMsg` or `assistantMsg`. 3. `fs.appendFileSync` stores the content verbatim in `workspace/chat/YYYY-MM-DD.m ...[truncated 807 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user opt-in before enabling conversation logging, and provide a clear per-session disable mechanism. 2. Redact passwords, API keys, access tokens, authorization headers, private keys, personal identifiers, and other configured sensitive patterns before writing any entry. 3. Allow users to exclude individual messages, tool outputs, attachments, and designated sensitive conversations from logging. 4. Store records using a structured format such as JSON Lines, with untrusted fields encoded by a standard serializer rather than interpolated into Markdown. 5. If Markdown remains necessary, escape or delimit multiline message content so it cannot create forged timestamps or speaker records. 6. Create the log directory and files with restrictive permissions appropriate to the operating system, such as owner-only access where supported. 7. Encrypt logs at rest when conversations may contain confidential information, with encryption keys stored separately from the logs. 8. Implement configurable retention limits, secure deletion, log rotation, and a documented process for users to inspect and remove stored data. 9. Avoid placing logs in automatically synchronized or shared workspace locations unless users explicitly approve that exposure. 10. Handle filesystem failures safely and document that append-only behavior does not provide tamper resistance or a trustworthy compliance audit trail.