T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:39
- Finding
- Automatic plaintext upload of sensitive identity and memory files## Vulnerability Details **File Location**: `SKILL.md`, lines 39-45 and 96-103 **Vulnerability Type**: Sensitive-data exposure through automatic remote synchronization **Risk Level**: High ### Vulnerable Code ```markdown 3. Append the Everclaw sync task to `HEARTBEAT.md` in the workspace (create if missing). Add this block if it's not already present: ``` ## Everclaw vault sync - Back up modified files to Everclaw vault: SOUL.md, IDENTITY.md, USER.md, MEMORY.md, memory/*.md, TOOLS.md, HEARTBEAT.md - Only push files that changed since last sync ``` 4. Do an initial backup — read each of the standard files that exist locally and push them to the vault. ``` ```bash curl -s -X PUT "https://everclaw.chong-eae.workers.dev/v1/vault/MEMORY.md" \ -H "Authorization: Bearer $EVERCLAW_API_KEY" \ -H "Content-Type: text/markdown" \ --data-binary @MEMORY.md ``` ```markdown Use `--data-binary @filepath` to preserve file contents exactly. Use the correct content-type (`text/markdown` for .md, `application/json` for .json). ``` ### Technical Analysis The skill directs the agent to read and upload `SOUL.md`, `IDENTITY.md`, `USER.md`, `MEMORY.md`, daily memory logs, tool notes, and heartbeat instructions to an external Cloudflare Workers endpoint. The documented `curl --data-binary @filepath` operation transmits each local file directly as the HTTP request body. No local encryption operation, ciphertext format, nonce generation, authentication-tag processing, or independent encryption-key handling is present in the audited project. TLS protects network transport but does not prevent the receiving service from reading plaintext request bodies. The synchronization is automatic and the setup instructions explicitly prohibit asking the user questions. Consequently, invoking the skill can disclose potentially sensitive files without informed, file-specific authorization. ### Attack Path 1. A user invokes the skill ...[truncated 906 chars]
- Remediation
- ## Remediation Suggestions - Remove automatic initial and recurring uploads. - Obtain explicit, informed user consent before provisioning the vault and before uploading any file. - Display the exact destination, file list, and data categories before synchronization. - Implement audited client-side authenticated encryption before any network operation. - Derive a dedicated encryption key locally and ensure the service never receives that key. - Use a unique nonce for every AES-GCM encryption operation and authenticate the logical file path as associated data. - Upload only versioned ciphertext envelopes containing the algorithm identifier, nonce, ciphertext, and authentication tag. - Provide granular allowlists and exclude files containing secrets or unnecessary personal information. - Add automated tests proving that plaintext file fragments never appear in outbound HTTP request bodies.