T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/log-decision.mjs:6- Finding
Unredacted User Task Content Persisted in Plaintext
- Content
View full analysis
s.trim()).filter(Boolean) : [], accepted: args.accepted ? args.accepted.split(",").map((s) => s.trim()).filter(Boolean) : [], mode: args.mode || "unknown", }; fs.mkdirSync(path.dirname(LOG_PATH), { recursive: true }); fs.appendFileSync(LOG_PATH, `${JSON.stringify(row)}\n`, "utf-8"); ``` The logging behavior is mandated by `SKILL.md:91-112`, which instructs the agent to pass the complete user task through the `--task` argument after every proposal. ### Technical Analysis The logger writes the entire user task to a persistent JSONL file without data minimization, secret redaction, explicit user consent, retention controls, or restrictive file permissions. User tasks may contain credentials, API tokens, personal information, proprietary source code, internal infrastructure details, or other confidential content. `fs.appendFileSync` uses the process's normal file-creation behavior and does not explicitly require permissions such as `0600`. The fixed, developer-specific absolute path also causes the script to write outside its installation directory and may create an unexpected directory hierarchy through `fs.mkdirSync`. There is no remote exfiltration or privilege escalation in the reviewed code. Exploitation requires another process or user to have permission to read the resulting workspace file. ### Attack Path 1. A user submits a task containing confidential information, such as an API token, internal code, or personal data. 2. The Skill proposes one ...[truncated 999 chars]- Remediation
View remediation