T09 · Insecure Skill Coding Practices
- Location
SKILL.md:153- Finding
Sensitive Form Data and URL Secrets May Be Persisted in Plaintext Artifacts
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 153–193
Vulnerability Type: Sensitive data exposure through screenshots and operation logs
Risk Level: MediumVulnerable Code Snippet
The following is an English rendering of the relevant instructions:
text Form-filling rules: - Display the field list and request confirmation before every fill operation - Save a screenshot after filling for retrospective review - Do not submit forms automatically by default; require confirmation again - Do not record password fields in logs; display them as *** All operations are recorded in: ~/workspace/browser/logs/YYYY-MM-DD.jsonl {"ts":"2026-07-18T14:30:22+08:00","op":"open","url":"https://example.com","status":"success","id":"op_001"} {"ts":"2026-07-18T14:32:10+08:00","op":"fill_form","url":"https://example.com/form","fields":["name","phone","address"],"confirmed":true,"id":"op_002"} {"ts":"2026-07-18T14:35:00+08:00","op":"scrape","url":"https://example.com/data","records":25,"format":"csv","id":"op_003"}The related retention configuration at lines 260–271 only recommends cleanup and supplies a
retention_dayssetting:json { "browser_path": "/usr/bin/google-chrome", "default_timeout_seconds": 30, "screenshot_format": "png", "retention_days": 30 }Technical Analysis
The skill directs the agent to save a screenshot after a form is populated. A populated page can visibly contain personal information, addresses, telephone numbers, account identifiers, payment information, password values revealed by page controls, authentication recovery data, or other confidential content.
Although the instructions mask password fields in operation logs, no equivalent redaction requirement is defined for screenshots. The protection therefore covers only one logging channel and does not prevent visual disclosure through image artifacts.
Operation logs also retain complete U ...[truncated 2166 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable post-fill screenshots by default when a page contains password, payment, identity, authentication, health, or other sensitive fields.
- Require separate, explicit consent before capturing a populated form; ordinary consent to fill the form should not imply consent to persist its contents.
- Redact or mask sensitive input regions before capture. Include password fields, payment fields, security answers, tokens, government identifiers, and user-designated confidential fields.
- Sanitize logged URLs by removing user information, query strings, and fragments. If diagnostic context is required, log only the scheme, normalized host, and path, with an explicit allowlist for safe parameters.
- Create directories and files with owner-only permissions, such as
0700for directories and0600for files, subject to platform support. - Encrypt sensitive artifacts at rest using platform-managed keys and avoid synchronizing them to shared or untrusted storage.
- Implement and test retention enforcement rather than merely documenting
retention_days. Apply short default retention periods and provide immediate secure deletion. - Do not include raw field values in logs. Continue recording only non-sensitive field names and operational metadata.
- Add automated tests verifying screenshot redaction, URL sanitization, file permissions, and expiration of retained artifacts.
- Clearly warn users when screenshots or logs will persist beyond the current session and provide a command to review and delete them.