T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:413- Finding
Sensitive configuration may be disclosed during mandatory multi-model validation
- Content
View full analysis
connection strings (keep exact — NEVER compress facts/credentials/URLs) ``` ### Technical Analysis The workflow directs the agent to read all automatically loaded configuration files and preserve connection strings, credentials, and URLs exactly. It then makes validation with at least two different LLM models mandatory. No instructions require secret detection, redaction, placeholder substitution, provider allowlisting, local-only evaluation, or separate user approval before sending converted content to additional model providers. If a user's `CLAUDE.md` or related rule files contain credentials, internal URLs, server details, tokens, or connection strings, the converted document may retain those values and expose them during cross-model validation. This is an insecure handling practice because data initially stored in a local configuration can cross one or more external provider trust boundaries without a defined minimization or redaction step. ### Attack Path 1. A user stores a credential, private URL, connection string, or infrastructure detail in `CLAUDE.md` or an automatically loaded rule file. 2. The Skill reads all automatically loaded files during the preview and convers ...[truncated 1077 chars]- Remediation
View remediation
` section from external model test prompts. 4. Require explicit user approval before transmitting any configuration to a second model provider. 5. Provide a local-only validation mode and make it the default. 6. Document which providers receive test data and their retention boundaries. 7. Maintain a denylist for common secret formats and support entropy-based detection for unknown tokens. 8. Restore redacted values locally only after testing, without exposing them to external models. 9. Change the template instruction from preserving credentials to preserving only non-sensitive structural facts. ]]>