T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:35- Finding
Plaintext Persistence of Sensitive Emotional-Health Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35–64
Vulnerability Type: Plaintext storage of sensitive user data
Risk Level: MediumVulnerable Code
markdown At the **start of every session**, read the file `mood-checkin-profile.json` in the current working directory using the Read tool. If it exists, load the user's profile. If not, treat them as a new user. At the **end of every session**, write an updated `mood-checkin-profile.json` using the Write tool. Schema: ```json { "sessionsCompleted": 0, "currentStreak": 0, "longestStreak": 0, "lastSessionDate": null, "solGrowthStage": 1, "moodHistory": [], "archetypeHistory": [], "currentArchetype": null, "weeklyMoods": [], "monthlyData": { "month": null, "checkins": 0, "avgMood": null, "topEmotions": [], "moodByDay": {}, "patterns": [] } }Profile rules
- Mood history: Append each check-in:
{ "date": "2026-03-31", "rating": 3, "emotion": "restless", "weatherReport": "Partly cloudy with scattered overthinking", "mode": "checkin" }. Keep last 30 entries. - Streak tracking: Increment if last session was yesterday or today. Reset to 1 if more than one day gap. Update
longestStreakif current exceeds it. Streak drives Sol's growth stage (see Sol Growth below). - Weekly moods: Track the last 7 check-ins for archetype calculation.
- Monthly data: Aggregate for the Monthly Wrapped feature. Reset when the month changes.
text Additional mandatory writes and processing occur at `SKILL.md`, lines 163–164, 354–398, and 555–560. ### Technical Analysis The skill requires automatic storage of mood ratings, emotions, emotional summaries, inferred patterns, archetypes, and usage history in a predictable plaintext file named `mood-checkin-profile.json` in the current working directory. This information is sensitive because it can reveal a user's emo ...[truncated 1730 chars]- Mood history: Append each check-in:
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed opt-in before enabling cross-session persistence.
- Support a non-persistent mode and provide commands to inspect, export, disable, and permanently delete stored data.
- Store profiles in a dedicated per-user application-data directory rather than the current working directory.
- Create storage directories and files with owner-only permissions, such as
0700for directories and0600for files on compatible systems. - Encrypt sensitive profile contents at rest using operating-system credential storage or a properly managed per-user key.
- Minimize collection by retaining only fields necessary for requested functionality. Avoid storing free-form emotional text unless the user specifically opts in.
- Define and enforce a retention period for mood entries and derived emotional information.
- Warn users if the selected storage location is shared, synchronized, or inside a source-control repository.
- Validate the profile against a strict schema before loading it. Reject unexpected fields, excessive data, malformed types, and unsupported versions.
- Verify file type and ownership where the platform permits, and reject symbolic links or files owned by another user to reduce profile substitution risks.
- Use atomic writes and avoid following symbolic links when creating or updating the profile.
- Clearly disclose what information is stored, where it is stored, how long it is retained, and who may be able to access it.