T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:413
- Finding
- Sensitive configuration may be disclosed during mandatory multi-model validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:413-421` and `SKILL.md:475-476` **Vulnerability Type**: Sensitive data exposure across external LLM trust boundaries **Risk Level**: High ### Vulnerable Code ```text Then: Read all auto-loaded files. Identify redundancy, prose overhead, and duplicate rules. **Ask user before proceeding: "Want to distill?"** ### Stage 2: DISTILL — Convert with Safety Net 1. **Backup**: `cp ~/.claude/CLAUDE.md ~/.claude/CLAUDE.md.bak-pre-distill` 2. **Phase 1-5**: Run the full conversion process above 3. **Phase 6**: Run multi-model test (minimum 2 models, 8 questions) 4. **Report**: Show before/after scores ``` The template also instructs the conversion process to preserve sensitive connection information: ```text <conn> connection strings (keep exact — NEVER compress facts/credentials/URLs) </conn> ``` ### Technical Analysis The workflow directs the agent to read all automatically loaded configuration files and preserve connection strings, credentials, and URLs exactly. It then makes validation with at least two different LLM models mandatory. No instructions require secret detection, redaction, placeholder substitution, provider allowlisting, local-only evaluation, or separate user approval before sending converted content to additional model providers. If a user's `CLAUDE.md` or related rule files contain credentials, internal URLs, server details, tokens, or connection strings, the converted document may retain those values and expose them during cross-model validation. This is an insecure handling practice because data initially stored in a local configuration can cross one or more external provider trust boundaries without a defined minimization or redaction step. ### Attack Path 1. A user stores a credential, private URL, connection string, or infrastructure detail in `CLAUDE.md` or an automatically loaded rule file. 2. The Skill reads all automatically loaded files during the preview and convers ...[truncated 1077 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add a mandatory secret-scanning and redaction phase before conversion or validation. 2. Replace credentials, tokens, private URLs, connection strings, IP addresses, and sensitive paths with stable placeholders such as `${REDACTED_SECRET_1}`. 3. Exclude the entire `<conn>` section from external model test prompts. 4. Require explicit user approval before transmitting any configuration to a second model provider. 5. Provide a local-only validation mode and make it the default. 6. Document which providers receive test data and their retention boundaries. 7. Maintain a denylist for common secret formats and support entropy-based detection for unknown tokens. 8. Restore redacted values locally only after testing, without exposing them to external models. 9. Change the template instruction from preserving credentials to preserving only non-sensitive structural facts. ]]>