T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Overbroad Collection of Sensitive Agent Trace Data## Vulnerability Details **File Location**: `SKILL.md`, lines 25–29 **Vulnerability Type**: Sensitive data exposure through insecure trace-handling guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Required Inputs Ask for (if not already provided): - **What the agent did** and what it should have done - **The trace** — the full request: system prompt, context, tool calls and results, output. If no trace exists, that absence is itself a finding - **Blast radius** — how many users/requests, over what window, and whether it's ongoing - **Detection** — how it was noticed (user report? monitor? luck?) and how long after it started ``` ### Technical Analysis The skill explicitly directs the agent to request the complete incident trace, including the system prompt, contextual material, tool calls, tool results, and generated output. Such traces can contain credentials, API tokens, privileged system instructions, personal information, confidential documents, internal service responses, or other data unrelated to the incident. The guidance does not require data minimization, authorization checks, secret scanning, redaction, output sanitization, secure retention, or need-to-know access controls. Consequently, sensitive material can be copied into the agent's context and subsequently reproduced in a postmortem, logs, evaluation fixtures, or downstream records. This is an insecure handling practice rather than evidence of intentional exfiltration. No instruction to transmit the collected data to an external party was identified. ### Attack Path 1. An operator or attacker submits a request to create an AI incident postmortem. 2. Following the skill, the agent requests the full trace rather than only incident-relevant excerpts. 3. The supplied trace includes secrets or confidential content embedded in system prompts, retrieved context, tool arguments, or tool results. 4. The agent ingests that materia ...[truncated 865 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the requirement for a “full” trace with a request for the minimum incident-relevant trace segments. 2. Require authorization before retrieving privileged prompts, internal tool responses, or user data. 3. Mandate preprocessing that removes credentials, API keys, session tokens, cookies, personal data, and unrelated confidential content. 4. Use explicit placeholders such as `[REDACTED_TOKEN]` while preserving only the structural information needed for analysis. 5. Add secret scanning and personal-data detection before traces enter the agent context and again before the report is saved or shared. 6. Define access controls, encryption, retention periods, and deletion procedures for traces, postmortems, and regression fixtures. 7. Require permanent regression cases to use sanitized or synthetic data rather than raw production traces. 8. Add a quality check confirming that the final postmortem contains no unnecessary secrets or personal information.