other
Warning
- Location
SKILL.md:20- Finding
Sensitive AI Session Data May Be Persisted or Uploaded Without Mandatory Safeguards
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 20-85
Vulnerability Type: Sensitive conversation, prompt, reasoning, and metadata collection
Risk Level: MediumVulnerable Snippet
The following is an English translation of the relevant directives in
SKILL.md:markdown ## Content a checkpoint should contain When generating or committing AI code, associate the following information with the commit: | Content | Description | | Prompts | The main user or system prompts that triggered generation; these may be redacted. | | Conversation history | A summary or relevant turns from the conversation. | | Reasoning steps | The model or agent's reasoning chain, attempted approaches, and reasons for selecting the implementation. | | Decision logic | Key decisions and their rationales. | | Metadata | Optionally, token usage, model/version, timestamp, and affected files. | | Associated commit | The corresponding commit hash or branch and pending commit description. | ## Methods for binding the checkpoint to a commit - Maintain checkpoint files in `.checkpoints/` or `docs/checkpoints/`. - Reference the checkpoint file from a commit message or tag. - If a checkpoint tool or service exists, use its API or CLI to upload the content and store a URL or identifier in the repository. { "commit": "abc123...", "timestamp": "ISO8601", "prompts": ["original or summarized user request"], "conversation_summary": "conversation points related to the change", "reasoning_steps": ["step 1", "step 2", "..."], "decisions": ["decision and rationale", "..."], "files_changed": ["path/a", "path/b"], "meta": { "model": "optional", "tokens_used": "optional", "agent_version": "optional" } }Technical Analysis
The Skill directs an agent to collect and persist prompts, conversation history, reasoning steps, decision logic, and execution metadata. Such m ...[truncated 2276 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to a minimal, high-level change summary rather than complete prompts, conversations, or reasoning traces.
- Explicitly prohibit collection of hidden reasoning, system instructions, authentication material, private keys, access tokens, session cookies, and complete conversation transcripts.
- Require explicit user approval before creating, committing, or uploading each checkpoint.
- Show the exact payload and destination to the user before any persistence or transmission occurs.
- Apply mandatory secret, personal-data, and proprietary-information detection before storage.
- Replace sensitive values with irreversible placeholders and record only the minimum information needed for auditability.
- Keep checkpoint files outside version control by default. If repository storage is required, use restricted access and avoid permanent Git history where possible.
- Allow external transmission only to explicitly approved destinations using authenticated and encrypted connections.
- Define retention periods, deletion procedures, access controls, and audit logging for checkpoint records.
- Document that removing a file from the working tree does not remove it from Git history, and provide a secure history-rewrite and credential-rotation process for accidental disclosures.