T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:67- Finding
Plaintext Aggregation and Indexing of Sensitive Memory Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:67-111;references/facts-yaml-template.md:6-42;references/lookup-index-template.md:7-18
Vulnerability Type: Plaintext storage and indexing of sensitive information
Risk Level: MediumVulnerable Code Snippets
SKILL.md:67-111:markdown ### Step 1: Audit existing MEMORY.md Read the full file and categorize every piece of information: - **Fact** → moves to `facts.yaml` (name, email, date, number, path, ID, status) - **Behavioral rule** → stays in MEMORY.md - **Narrative/context** → stays in MEMORY.md (relationship descriptions, quotes, origin stories) - **Project detail** → moves to or stays in `project-*.md` ### Step 2: Build `memory/facts.yaml` Use this schema pattern: ```yaml # memory/facts.yaml # Structured factual data — directly addressable, token-efficient # Last updated: YYYY-MM-DD identity: full_name: ... email: ... telegram_id: ... health: condition: ... status: ... technical: machine: ... os: ... workspace: ... paths: api_keys: ... error_log: ... projects: project_name: {file: memory/project-name.md, status: "one-line status"} todos: - Todo item one - Todo item twotext `references/facts-yaml-template.md:6-42`: ```yaml identity: full_name: preferred_name: email: phone: timezone: age: # ── HEALTH (if relevant) ────────────────────────────────── health: # condition: # status: # ── FAMILY / RELATIONSHIPS ──────────────────────────────── family: # spouse: # name: # children: [] # ── AGENT IDENTITY ──────────────────────────────────────── agent: name: first_session: YYYY-MM-DD # voice_id: # ── TECHNICAL SETUP ─────────────────────────────────────── technical: machine: os: workspace: # ── FILE PATHS ──────────────────────────────────────────── paths: # api_keys: ...[truncated 3847 chars]- Remediation
View remediation
Remediation Suggestions
- Exclude secrets by default: Explicitly prohibit API keys, passwords, tokens, private keys, recovery codes, and raw authentication material from
facts.yamland the lookup index. - Use a secret manager: Store credentials in an operating-system keychain, environment-specific secret store, or dedicated secrets manager. Record only a non-sensitive reference identifier when necessary.
- Redact index entries: Do not list exact credential paths. Replace entries such as
API keys | [your path here]with guidance to use the approved secret-management interface. - Apply data minimization: Make health, family, contact, and account sections opt-in. Collect only information necessary for an explicitly stated agent function.
- Require informed consent: Before migrating sensitive categories, present the categories to the user and obtain explicit approval for each one.
- Restrict permissions: Require generated memory files and directories to use the narrowest feasible filesystem permissions, such as owner-only access where supported.
- Separate sensitivity domains: Avoid placing personal information, system configuration, and account metadata in one centralized file. Store sensitive categories separately with independent access controls.
- Define retention controls: Document review, expiration, deletion, and secure migration procedures for stale or unnecessary data.
- Add disclosure safeguards: Instruct agents not to reproduce sensitive memory content in responses unless necessary and explicitly authorized.
- Validate generated content: Scan migrated values for credentials and other high-risk patterns before writing the resulting files.
- Exclude secrets by default: Explicitly prohibit API keys, passwords, tokens, private keys, recovery codes, and raw authentication material from