T09 · Insecure Skill Coding Practices
- Location
scripts/collector.py:251- Finding
Content Is Persisted Without the Documented User Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/collector.py:156andscripts/collector.py:251-260; related documented confirmation requirement atSKILL.md:42-45andREADME.md:42-44
Vulnerability Type: Missing confirmation and consent enforcement before persistent storage
Risk Level: MediumVulnerable Code
At
scripts/collector.py:156, the complete input is appended to the generated record without redaction:python content += f"\n\n## Original Content\n\n{raw_text}\n"At
scripts/collector.py:251-260, storage occurs immediately after processing, without checking for user approval:python classification = classify(input_text) metadata = extract_metadata(input_text) markdown_content = fill_template(classification, metadata, input_text, title) entity_id = save_to_domain_kit(markdown_content, classification, metadata)The documented workflow in
SKILL.md:42-45requires a preview and user confirmation before storage, butcollect()has no confirmation parameter or approval-state check.Technical Analysis
The collection operation combines content preparation and persistent commitment into one unconditional execution path. Any caller invoking
collect()causes the input to be classified, embedded in a Markdown record, and written throughsave_to_domain_kit().Because
fill_template()appends the entire original input, the stored record may include source code, internal project identifiers, operational details, credentials accidentally included in text, or unrelated group-chat content. No redaction, sensitive-data detection, authorization check, or explicit consent gate is applied.The issue is particularly relevant to the documented automatic group-chat workflow: keyword matching may select a technical message, after which the current implementation can persist it without the author reviewing the generated record. This is a consent-boundary and privacy-control failure ...[truncated 1523 chars]
- Remediation
View remediation
Remediation Suggestions
-
Separate record preparation from persistent commitment:
- Implement a preparation function that performs classification, metadata extraction, and template generation.
- Return the generated preview without writing to storage.
- Implement a separate commit function that accepts a server-generated approval token.
-
Enforce confirmation in code rather than relying on conversational instructions:
python def collect(input_text, source_type="manual", title=None, confirmed=False): preview = prepare_entry(input_text, source_type, title) if not confirmed: return {"status": "awaiting_confirmation", "preview": preview} return commit_entry(preview) -
Do not allow automatic group-chat detection to persist content directly. Require the message author or an authorized moderator to approve each proposed entry.
-
Bind approval to the exact preview using a record identifier or cryptographic digest so content cannot change between preview and commitment.
-
Apply sensitive-data controls before preview and storage:
- Detect likely secrets, credentials, personal data, and restricted project identifiers.
- Redact or reject sensitive content.
- Avoid retaining the complete raw message unless explicitly required and approved.
-
Add authorization checks for both submission and approval, and record the submitter, approver, source type, approval time, and content digest in provenance metadata.
-
Add tests verifying that:
- Unconfirmed records are never written.
- Rejected records are never written.
- Automatic chat detection only creates a preview.
- Modified previews require renewed approval.
- Sensitive-content policies are enforced before commitment.
-