T09 · Insecure Skill Coding Practices
- Location
scripts/model_router.py:110- Finding
Full User Queries Stored in Plaintext Without Explicit Consent or Access Hardening
- Content
View full analysis
Vulnerability Details
File Location:
scripts/model_router.py, lines 110-132
Vulnerability Type: Plaintext sensitive-data retention
Risk Level: MediumVulnerable Code:
python def _log_query(self, query, tier): """Logs the query for future keyword refinement.""" try: history = [] if os.path.exists(self.history_file): with open(self.history_file, 'r', encoding='utf-8') as f: try: history = json.load(f) except: history = [] history.append({"query": query, "tier": tier, "timestamp": os.path.getmtime(self.history_file) if os.path.exists(self.history_file) else 0}) # Keep only last 1000 queries if len(history) > 1000: history = history[-1000:] with open(self.history_file, 'w', encoding='utf-8') as f: json.dump(history, f, ensure_ascii=False, indent=2) except Exception as e: passTechnical Analysis
Every call to
route()invokes_log_query(), which appends the complete query to a local JSON file. Queries can contain credentials, source code, personal information, financial data, or proprietary business content. The implementation neither redacts sensitive values nor encrypts the stored content. It also creates the history file using default process permissions rather than explicitly restricting it to the owning user.Retention is limited to 1,000 entries, but this still permits a substantial quantity of sensitive prompt data to accumulate. The documented rolling-adjustment feature does not clearly disclose that full query text is automatically retained, and the implementation provides no explicit consent, opt-out, or deletion mechanism.
Attack Path
- A user submits a query containing sensitive information.
ModelRouter.route()processes the query and au ...[truncated 907 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable full-query logging by default and require an explicit configuration option and informed user consent.
- Store only the minimum routing metadata needed for refinement, such as tier, confidence, and anonymized aggregate features.
- Redact credentials, API keys, access tokens, personal data, and other sensitive patterns before persistence.
- Create the history file with owner-only permissions, such as mode
0600, and verify permissions when opening an existing file. - Use a configurable, short retention period and provide deletion and logging opt-out mechanisms.
- Keep history outside source and package directories, and exclude it from version control, archives, telemetry, and backups where appropriate.
- If complete prompts are operationally necessary, encrypt the data at rest and protect encryption keys separately.
- Replace the blanket exception handler with controlled error reporting that does not expose prompt content.