T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:41
- Finding
- Unsafe Collection and Ambiguous Storage of User Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-46; related storage guidance at lines 58-59 **Vulnerability Type**: Credential exposure through insecure operational instructions **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 4. Gestione Accesso - Se l'accesso non è automatico (sessione scaduta/assente) - **FERMATI** e chiedi esplicitamente le credenziali - Non insistere, aspetta input dell'utente - Dopo aver ricevuto credenziali, prova il login ``` Related credential-storage guidance: ```markdown ## Note - Salva le credenziali in modo sicuro se l'utente le fornisce - Non conservare password in chiaro nei file di configurazione ``` ### Technical Analysis The Skill explicitly instructs the agent to request account credentials from the user and then use those credentials to log in to third-party services. It also permits credentials to be stored using an undefined “secure” method. No secure credential-entry channel, approved secret manager, retention period, access-control model, log-redaction requirement, or deletion procedure is defined. Consequently, a user may submit a password directly through the conversational interface, where it could be exposed through chat history, application logs, telemetry, agent context, screenshots, or implementation-dependent persistent storage. The instruction not to store plaintext passwords in configuration files is insufficient because it does not prohibit collection through chat or storage in other plaintext locations. Authentication should instead occur directly between the user and the official provider interface. ### Attack Path 1. The Skill navigates to Claude or Gemini and determines that no authenticated session exists. 2. Following the documented instructions, the agent asks the user to provide account credentials. 3. The user submits a username and password through the conversational interface. 4. The credentials become part of the agent context and may also enter c ...[truncated 1099 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every instruction that asks the user to provide usernames, passwords, recovery codes, session cookies, or multi-factor authentication secrets to the agent. 2. Require users to authenticate directly within the official provider-controlled browser interface. 3. Use an existing authenticated session or provider-supported OAuth/device authorization flow where available. 4. Explicitly instruct the agent to stop if credentials appear in chat, warn the user, and avoid repeating or storing the secret. 5. Prohibit credential persistence in files, chat memory, logs, environment variables, screenshots, and agent state. 6. If tokens must be handled by an authorized implementation, use an operating-system credential vault or dedicated secret manager with encryption, least-privilege access, expiration, rotation, and deletion controls. 7. Add mandatory log and telemetry redaction for passwords, authorization headers, cookies, and access tokens. 8. Document a clear retention and incident-response policy for accidentally disclosed credentials, including immediate revocation and rotation. ]]>