T09 · Insecure Skill Coding Practices
Warning
- Location
runtime_monitor.py:52- Finding
Plaintext Retention and Disclosure of Sensitive Monitored Data
- Content
View full analysis
Vulnerability Details
File Location:
runtime_monitor.py:52-62, with sensitive-data capture flows atruntime_monitor.py:215-225,runtime_monitor.py:238-248,runtime_monitor.py:339, andruntime_monitor.py:357
Vulnerability Type: Plaintext sensitive-data retention and exposure
Risk Level: MediumVulnerable Code
python @dataclass class DetectionResult: detection_type: DetectionType risk_level: RiskLevel risk_score: int matched_patterns: List[str] description: str timestamp: str = field(default_factory=lambda: datetime.now().isoformat()) raw_input: str = "" def to_dict(self) -> Dict: return { "detection_type": self.detection_type.value, "risk_level": self.risk_level.value, "risk_score": self.risk_score, "matched_patterns": self.matched_patterns, "description": self.description, "timestamp": self.timestamp, "raw_input": self.raw_input[:500] if self.raw_input else "" }Sensitive content is captured without redaction when a pattern matches:
python result = DetectionResult( detection_type=detection_type, risk_level=self._score_to_level(score), risk_score=score, matched_patterns=[description], description=f"Detected {detection_type.value}: {description}", raw_input=text )Tool arguments and outputs are serialized in full before analysis:
python text = json.dumps(arguments, ensure_ascii=False) return self.monitor(text, source=f"tool:{tool_name}")python if isinstance(output, str): text = output elif isinstance(output, (dict, list)): text = json.dumps(output, ensure_ascii=False) else: text = str(output) return self.monitor(text, source=f"output:{tool_name}")Technical Analysis
The monitor is specifically designed to identify crede ...[truncated 2698 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
raw_inputfromDetectionResultby default. Return only the detection type, matched rule identifier, risk score, source, and blocking decision. - If diagnostic evidence is necessary, make raw-content capture explicitly opt-in and disabled by default.
- Redact credentials before placing any excerpt in a report. Replace matched values with fixed placeholders such as
[REDACTED_API_KEY]or retain only a minimal suffix needed for correlation. - Apply redaction to the complete input before creating any
DetectionResult, rather than only when serializing the report. - Store match offsets or non-reversible keyed digests instead of plaintext values when event correlation is required.
- Limit excerpt length after redaction and avoid retaining duplicate copies when multiple patterns match the same input.
- Document that monitoring reports may contain security-sensitive metadata and must not be written to unrestricted logs or telemetry.
- Add tests verifying that API keys, access tokens, connection-string passwords, and bearer tokens never appear in report objects or serialized output.
- Apply strict retention and access controls to any downstream audit storage that receives monitoring results.
- Remove