T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:126
- Finding
- Persistent Storage of Sensitive Mental-Health Information Without Privacy Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:126-140` and `SKILL.md:363-368` **Vulnerability Type**: Sensitive health information stored without defined consent, minimization, retention, or access controls **Risk Level**: Medium ### Vulnerable Code `SKILL.md:126-140`: ```markdown ## User Preferences to Learn Over time, remember these preferences (via OpenClaw memory): **Schedule & Energy:** - Peak focus hours (morning person vs. night owl) - Typical energy patterns throughout the day - Best times for deep work vs. shallow tasks **Task Management:** - Preferred number of daily priorities (1-3 recommended) - Task/note storage location (files, apps, directories) - Preferred reminder frequency and channels **ADHD Profile:** - Diagnosed or suspected ADHD - Current treatments (medication, therapy) - for context only ``` `SKILL.md:363-368`: ```markdown ### Memory Usage: - Store user preferences and patterns - Remember what strategies have worked - Track routine adherence over time - Note energy patterns and triggers ``` ### Technical Analysis The skill explicitly directs the agent to retain diagnosed or suspected ADHD status, medication or therapy information, behavioral patterns, routine adherence, energy patterns, and triggers in persistent OpenClaw memory. Diagnosis and treatment details constitute sensitive health-related information. The instructions do not require explicit informed consent before persistence, limit collection to information essential for the requested task, define a retention period, provide deletion controls, restrict access to the stored information, or prohibit storing free-form medical and emotional details. This creates an insecure data-handling pattern: information that could have remained transient within the active conversation may instead become part of a long-term behavioral and health profile. The issue is classified as insecure skill configuration rather than agent memory poisoning because the skill do ...[truncated 1481 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not persist medical details by default** - Treat diagnosis status, medication, therapy, and emotional triggers as transient conversational context. - Remove these fields from the default list of information to remember. 2. **Require explicit, granular consent** - Ask the user before saving each category of sensitive information. - Clearly explain what will be saved, why it is needed, how long it will remain, and how it can be deleted. - Do not infer consent merely because the user disclosed information during a conversation. 3. **Apply data minimization** - Store operational preferences such as preferred reminder frequency or focus-block length instead of medical explanations. - For example, save “prefers reminders every 30 minutes,” not diagnosis or medication details. - Avoid storing free-form emotional histories or treatment notes. 4. **Define retention and deletion controls** - Establish a short default retention period for behavioral observations. - Provide commands for users to inspect, correct, export, and delete stored information. - Automatically remove obsolete routine and energy-pattern records. 5. **Restrict access** - Limit sensitive memory entries to the narrowest applicable user and skill scope. - Prevent unrelated skills and integrations from reading health-related records. - Use encryption at rest where supported and avoid including sensitive values in logs or telemetry. 6. **Add safe memory instructions** - Replace the current memory guidance with language such as: ```markdown Only store non-sensitive operational preferences after explicit user consent. Do not persist diagnosis status, medication, therapy information, crisis disclosures, or emotional triggers. Keep such information transient unless the user explicitly requests storage after being informed of retention and deletion controls. ``` ]]>