T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:50- Finding
Persistent Plaintext Storage of Sensitive Third-Party Profiles
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:50-67,SKILL.md:89-94,SKILL.md:145-150,SKILL.md:166-170,templates/SISTER-PROFILE.md:20-41,templates/INTERACTION-LOG.md:3-16
Vulnerability Type: Plaintext storage and indefinite retention of sensitive personal information
Risk Level: MediumVulnerable Code
SKILL.md:50-67:markdown ## Data Storage All data is stored **locally on the user's machine only**. No cloud sync. No external transmission.~/.sister-skill/ └── sisters/ └── [name]/ ├── PROFILE.md # Structured personality profile └── interaction-log.jsonl # Your observation log
text - **Storage location**: `~/.sister-skill/sisters/` - **Format**: Markdown profiles + JSONL logs (human-readable plain text) - **Cloud sync**: None. Zero external data transmission. - **Deletion**: Delete any profile by removing its folder - **Portability**: All files are plain text, fully portableSKILL.md:89-94:markdown ### The Unspoken Layer - What she means when she says "I'm fine" (genuinely fine / not fine / testing if you'll push) - Topics she avoids and why - How she shows love without saying it - What she needs but never asks forSKILL.md:166-170:markdown 1. **Never overwrite** — always add new memories alongside existing ones 2. **Track confidence** — "described 15 times" vs "mentioned once" 3. **Cross-session persistence** — load existing profiles before responding 4. **Timestamp everything** — every memory is logged with date 5. **Evolution tracking** — people change over time, track the evolutiontemplates/SISTER-PROFILE.md:20-41:markdown ## Emotional Intelligence - **How she gives advice:** - **How she supports during crisis:** - **How she handles HER crisis:** - **Apology style:** - **What "I'm fine" means when she says it:** ## Humor - **Type:** (self-deprecating / observational / storytelling / chaotic / dry wit) - **What makes her laugh:** - **How sh ...[truncated 3183 chars]- Remediation
View remediation
Remediation Suggestions
-
Obtain informed consent
- Require users to confirm that the profiled person has consented before creating persistent records.
- Disable persistent profiling by default for real individuals who have not consented.
- Require separate confirmation before generating first-person imitations.
-
Minimize collected data
- Remove fields that solicit avoided topics, crisis behavior, unspoken needs, trauma, health information, finances, or other sensitive inferences.
- Store summarized communication preferences rather than raw memories.
- Reject or redact secrets and highly sensitive personal information before persistence.
-
Protect data at rest
- Encrypt profiles and logs using a platform-backed credential or user-provided key.
- Create storage directories and files with owner-only permissions, such as directory mode
0700and file mode0600. - Avoid exposing names directly in predictable directory names; use non-identifying internal identifiers where practical.
-
Introduce retention controls
- Replace indefinite append-only storage with a configurable retention period.
- Provide automatic expiration and secure deletion options.
- Allow users to inspect and selectively delete individual observations, not only entire directories.
-
Make persistence opt-in
- Use session-only processing by default.
- Display the exact information and destination file before writing.
- Require explicit approval for every persistent update involving sensitive information.
-
Reduce backup and synchronization exposure
- Warn users that home-directory backup or synchronization software may copy the files despite the Skill having no cloud-sync feature.
- Document how to exclude the storage directory from unmanaged backups.
- Avoid claiming that no data leaves the device unless backup and host-agent behavior can be controlled.
-
Add privacy validation
- Before each write, ...[truncated 216 chars]
-