T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:67
- Finding
- Plaintext Aggregation and Indexing of Sensitive Memory Data## Vulnerability Details **File Location**: `SKILL.md:67-111`; `references/facts-yaml-template.md:6-42`; `references/lookup-index-template.md:7-18` **Vulnerability Type**: Plaintext storage and indexing of sensitive information **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:67-111`: ```markdown ### Step 1: Audit existing MEMORY.md Read the full file and categorize every piece of information: - **Fact** → moves to `facts.yaml` (name, email, date, number, path, ID, status) - **Behavioral rule** → stays in MEMORY.md - **Narrative/context** → stays in MEMORY.md (relationship descriptions, quotes, origin stories) - **Project detail** → moves to or stays in `project-*.md` ### Step 2: Build `memory/facts.yaml` Use this schema pattern: ```yaml # memory/facts.yaml # Structured factual data — directly addressable, token-efficient # Last updated: YYYY-MM-DD identity: full_name: ... email: ... telegram_id: ... health: condition: ... status: ... technical: machine: ... os: ... workspace: ... paths: api_keys: ... error_log: ... projects: project_name: {file: memory/project-name.md, status: "one-line status"} todos: - Todo item one - Todo item two ``` ``` `references/facts-yaml-template.md:6-42`: ```yaml identity: full_name: preferred_name: email: phone: timezone: age: # ── HEALTH (if relevant) ────────────────────────────────── health: # condition: # status: # ── FAMILY / RELATIONSHIPS ──────────────────────────────── family: # spouse: # name: # children: [] # ── AGENT IDENTITY ──────────────────────────────────────── agent: name: first_session: YYYY-MM-DD # voice_id: # ── TECHNICAL SETUP ─────────────────────────────────────── technical: machine: os: workspace: # ── FILE PATHS ──────────────────────────────────────────── paths: # api_keys: ...[truncated 3847 chars]
- Remediation
- ## Remediation Suggestions 1. **Exclude secrets by default:** Explicitly prohibit API keys, passwords, tokens, private keys, recovery codes, and raw authentication material from `facts.yaml` and the lookup index. 2. **Use a secret manager:** Store credentials in an operating-system keychain, environment-specific secret store, or dedicated secrets manager. Record only a non-sensitive reference identifier when necessary. 3. **Redact index entries:** Do not list exact credential paths. Replace entries such as `API keys | [your path here]` with guidance to use the approved secret-management interface. 4. **Apply data minimization:** Make health, family, contact, and account sections opt-in. Collect only information necessary for an explicitly stated agent function. 5. **Require informed consent:** Before migrating sensitive categories, present the categories to the user and obtain explicit approval for each one. 6. **Restrict permissions:** Require generated memory files and directories to use the narrowest feasible filesystem permissions, such as owner-only access where supported. 7. **Separate sensitivity domains:** Avoid placing personal information, system configuration, and account metadata in one centralized file. Store sensitive categories separately with independent access controls. 8. **Define retention controls:** Document review, expiration, deletion, and secure migration procedures for stale or unnecessary data. 9. **Add disclosure safeguards:** Instruct agents not to reproduce sensitive memory content in responses unless necessary and explicitly authorized. 10. **Validate generated content:** Scan migrated values for credentials and other high-risk patterns before writing the resulting files.