T09 · Insecure Skill Coding Practices
- Location
SKILL.md:75- Finding
Plaintext Persistence of Bearer Tokens and Identity Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 75–130 and 303–305
Vulnerability Type: Plaintext storage of authentication credentials and personally identifiable information
Risk Level: HighVulnerable Code Snippet
markdown ### Local state management (.agent-state.json) The Agent persists the token and commonly used personnel information through the `.agent-state.json` file in the workspace root. #### At the beginning of a conversation 1. Execute `date "+%Y-%m-%d %H:%M:%S %Z"` to obtain the current local time. 2. Read `.agent-state.json`. 3. If `token` exists and `expires` is later than the current timestamp, use that token directly and skip login. 4. If `policyholder` or `frequentInsured` contains data, prioritize it when placing subsequent orders. #### After successful login Write the login response to `.agent-state.json`, preserving the existing `policyholder` and `frequentInsured` values. It is also recommended to save `mobile`. { "token": "eyJhbGciOiJIUzI1NiIs...", "expires": 1735689600, "userId": 1001, "mobile": "13800138000", "policyholder": { "holderType": "individual", "fullName": "Zhang San", "idNumber": "310101199001011234", "mobileNumber": "13800138000" }, "frequentInsured": [ { "fullName": "Zhang San", "idNumber": "310101199001011234" }, { "fullName": "Li Si", "idNumber": "310101199101011234" } ], "schemaVersion": "2026.3", "schemaCache": {} } After an order is successfully created, write the policyholder and frequently insured persons to `.agent-state.json`, deduplicating by `idNumber`.The snippet above is an English rendering of the operative instructions and data structure in the cited source lines.
Technical Analysis
The Skill explicitly instructs the Agent to persist bearer tokens, mobile numbers, names, and government-issued identification numbers in a predictable plaintext file at the workspace root. A bearer token is a reusable credential: a ...[truncated 3006 chars]
- Remediation
View remediation
Remediation Suggestions
-
Move bearer tokens to protected credential storage
- Use the operating system keychain, a host-provided secret manager, or an Agent runtime credential vault.
- Store only an opaque credential reference in workspace state.
- Never place bearer tokens in project files or other routinely shared locations.
-
Stop retaining full identity records by default
- Require explicit, informed opt-in before saving frequently used persons.
- Retain only fields strictly necessary for the declared convenience feature.
- Prefer masked identifiers or a server-side record reference instead of complete ID numbers.
- Do not persist data for unrelated insured persons without appropriate authorization.
-
Protect any unavoidable local state
- Store it outside the project tree in a per-user application-data directory.
- Apply owner-only permissions, such as mode
0600on POSIX systems. - Use authenticated encryption with keys held outside the state file.
- Use atomic writes and reject symbolic links to avoid unsafe file replacement.
-
Prevent accidental propagation
- Add
.agent-state.jsonto.gitignoreand equivalent backup, archive, support-bundle, and telemetry exclusions. - Add repository scanning or pre-commit checks that block state files, bearer tokens, mobile numbers, and government ID patterns.
- Ensure logs and error messages redact authorization headers and identity fields.
- Add
-
Implement lifecycle controls
- Delete credentials immediately on logout, revocation, or expiration rather than merely checking the timestamp.
- Define short retention periods for saved customer records.
- Provide users with review, deletion, and “do not remember” controls.
- Rotate or revoke a token when unintended disclosure is suspected.
-
Reduce transactional risk
- Require fresh user confirmation for purchases, surrender, refund, invoice issuance, and irreversible invoice reversal. ...[truncated 186 chars]
-