T09 · Insecure Skill Coding Practices
- Location
SKILL.md:81- Finding
Mandatory Verbatim Logging Can Persist Sensitive User Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 81-82
Vulnerability Type: Unredacted plaintext persistence of arbitrary user input
Risk Level: MediumVulnerable Code Snippet
markdown ### MANDATORY: 审计日志 **所有用户输入必须原样记录**到 `aidlc-docs/audit.md`（时间戳用 ISO 8601）。禁止总结或改写用户原话。The associated persistence rule at
SKILL.md, line 229 states:markdown - 审计日志：追加到 `audit.md`，禁止覆盖This behavior conflicts with the security requirement at
references/extensions/security/baseline/security-baseline.md, lines 73-82:markdown ## Rule SECURITY-03: Application-Level Logging **Rule**: Every deployed application component MUST include structured logging infrastructure: - A logging framework MUST be configured - Log output MUST be directed to a centralized log service - Logs MUST include: timestamp, correlation/request ID, log level, and message - Sensitive data (passwords, tokens, PII) MUST NOT appear in log output **Verification**: - Every service/function entry point includes a configured logger - No ad-hoc logging statements used as the primary logging mechanism in production code - Log configuration routes output to a centralized log service - No secrets, tokens, or PII are loggedTechnical Analysis
The Skill requires every user input to be copied verbatim into a persistent workspace file. The instruction is unconditional and provides no secret detection, redaction, user consent, retention limit, access restriction, or exclusion for passwords, API keys, tokens, personal data, and confidential source material.
Because the audit file is append-only, accidentally disclosed information remains present unless a user manually violates the stated no-overwrite rule or removes the file. The project may subsequently be committed to source control, copied into build artifacts, synchronized to backups, or shared with collaborators.
The bundled security baseline prohibits secrets, tokens, and personally identifiable information i ...[truncated 1708 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace verbatim transcript logging with structured summaries that record only workflow-relevant decisions and state changes.
- Apply secret and PII detection before every audit write. Redact passwords, API keys, bearer tokens, cookies, private keys, connection strings, and personal identifiers.
- Explicitly state that the security baseline overrides audit completeness whenever the two requirements conflict.
- Obtain informed user consent before retaining prompt content, and provide a supported opt-out mechanism.
- Define retention and deletion policies, including a command or workflow for securely removing audit data.
- Restrict file permissions so the audit file is readable only by the project owner where the platform permits it.
- Add
aidlc-docs/audit.mdto.gitignoreby default, or store only a sanitized audit artifact suitable for source control. - Validate audit content before persistence and reject or redact suspected credentials rather than writing them unchanged.
- Add tests covering secret-bearing prompts and verify that raw sensitive values never appear in the audit file.
- Update the rule to language such as:
markdown Record a sanitized summary of each user interaction in `aidlc-docs/audit.md`. Never store passwords, tokens, secrets, private keys, PII, or other sensitive content. Obtain explicit consent before retaining any raw user text.