T09 · Insecure Skill Coding Practices
- Location
SKILL.md:45- Finding
Indiscriminate Plaintext Persistence of Scheduled Job Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45-58
Vulnerability Type: Mandatory plaintext retention without data minimization, access controls, redaction, or expiration
Risk Level: Medium
Classification: T09: Insecure Skill Coding PracticesVulnerable Code
markdown IMPORTANT DEFAULT BEHAVIOR: Every cron job created by this skill MUST automatically record its output into the daily intelligence log. All jobs should append their results to: intel/daily/YYYY-MM-DD.md Rules: - Each job must append a section with the job name and timestamp. - The file acts as the persistent data layer for trend analysis. - 7‑day, weekly, and 30‑day analysis jobs must read from the `intel/daily` directory instead of relying on live searches. - If the daily file does not exist it must be created automatically.Technical Analysis
The skill requires every scheduled job to persist its complete output in Markdown files under
intel/daily. This requirement applies indiscriminately and does not provide:- User consent or an option to disable persistence.
- Classification of sensitive versus non-sensitive output.
- Redaction of credentials, personal data, private URLs, tokens, or confidential monitoring results.
- File permission requirements.
- Retention limits or secure deletion.
- Integrity controls for content consumed by subsequent analysis jobs.
Scheduled tasks may process sensitive sources, private repositories, internal monitoring targets, email content, price or account information, and delivery metadata. If such information appears in task output, it will be retained in plaintext.
The requirement that weekly and 30-day analysis jobs read this directory broadens exposure: untrusted or attacker-influenced content written by one job is automatically placed in the input set of later jobs. Although the reviewed text does not explicitly instruct the agent to execute embedded cont ...[truncated 1570 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mandatory retention with explicit, informed user consent and make persistence configurable per task.
- Default to storing only structured summaries and metadata rather than complete raw output.
- Add an allowlist-based redaction layer for credentials, authorization headers, API tokens, webhook URLs, email addresses, phone numbers, private URLs, and other sensitive fields.
- Prohibit jobs from logging secrets or raw credential-bearing responses.
- Require restrictive filesystem permissions for the intelligence directory and files, such as owner-only access where supported.
- Define configurable retention periods and automatically delete or securely archive expired records.
- Separate data by task and sensitivity level instead of aggregating all output into a shared daily file.
- Treat all stored job output as untrusted data. Downstream analysis prompts should clearly delimit stored content and instruct agents never to follow instructions contained within it.
- Prevent downstream reports from being sent externally unless the user has approved both the destination and the data classification.
- Document backup, synchronization, deletion, and incident-response behavior for retained intelligence records.