T09 · Insecure Skill Coding Practices
- Location
scripts/memory_search.py:80- Finding
Search Results May Disclose Credentials and Other Sensitive Note Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/memory_search.py, lines 24–25 and 80–82
Vulnerability Type: Sensitive information exposure
Risk Level: MediumVulnerable Code:
python with open(path, encoding="utf-8", errors="replace") as fh: lines = fh.read().splitlines()python print(f"\n📄 {r['path']} (score={r['score']}, 命中{r['matched']}行)") for ln, snippet in r["hits"][:5]: print(f" L{ln}: {snippet[:160]}")Technical Analysis
The search function reads the complete contents of every eligible note and returns matching excerpts without classifying or redacting sensitive information. The output includes both the source path and up to 160 characters from each selected context snippet.
Consequently, passwords, API tokens, private-key material, connection strings, recovery codes, or other secrets stored in Markdown or text notes may be emitted into terminal history, application logs, agent context, or downstream responses. This behavior also conflicts with the security boundary documented in
SKILL.md, which states that credential-like content must not be exposed in responses.The vulnerability does not independently grant access to files that the process cannot read. Exploitation requires a sensitive file to be included in the selected search scope and a query that causes its sensitive content or surrounding context to be returned.
Attack Path
- A credential or another secret is stored in an indexed
.md,.txt, or.markdownfile. - The user or an attacker influencing the query submits a term appearing in or near the secret.
score_filereads the complete file and constructs a context snippet around the matching line.mainprints the snippet without sensitive-data detection or redaction.- The secret becomes available through command output, logs, agent context, or a response generated from that output.
Impact Assessment
An attacker may ob ...[truncated 385 chars]
- A credential or another secret is stored in an indexed
- Remediation
View remediation
Remediation Suggestions
- Apply output redaction before printing snippets. Detect common API-token formats, password assignments, authorization headers, connection strings, recovery codes, and private-key blocks.
- Suppress or mask the sensitive value while retaining only enough surrounding context to identify the source safely.
- Exclude known credential and secret files by default, including environment files, key files, password stores, and backup copies.
- Require explicit confirmation before displaying a result classified as potentially sensitive.
- Avoid placing raw search output in persistent logs or unrestricted agent context.
- Add automated tests verifying that representative credentials and private-key blocks are never returned verbatim.