T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:181
- Finding
- Automatic Plaintext Persistence of Conversation Content## Vulnerability Details **File Location**: `SKILL.md:181-194` **Vulnerability Type**: Plaintext storage of potentially sensitive conversation and report content **Risk Level**: Medium ### Vulnerable Code Snippet ```json { "id": "KR-20260312-001", "type": "deadline", "title": "项目交付", "context": "讨论项目进度时确定", "source": "conversation", "source_text": "项目要在3月20日前完成", "datetime": "2026-03-20T18:00:00+08:00", "status": "pending", "priority": "high", "logged_at": "2026-03-12T14:00:00+08:00" } ``` The storage location and directory-creation instruction are also documented at `SKILL.md:102-106`: ```bash mkdir -p ~/.openclaw/workspace/.keyrecords/{时间类,问题类,决策类,承诺类,过程类,知识类,人物类} ``` ### Technical Analysis The Skill is designed to automatically extract information from conversations and reports and persist it in JSON records. The documented schema retains the original input in the `source_text` field and also stores contextual information. The detection patterns cover broad categories such as stakeholders, commitments, operational problems, resources, and decision context. No consent gate, sensitive-data filtering, secret redaction, encryption, restrictive file-permission requirement, retention limit, or deletion workflow is specified. Consequently, confidential business information, personal data, internal operational details, or credential-adjacent content may be retained in plaintext without the user making a deliberate per-record storage decision. The package contains documentation rather than an executable implementation, so the finding applies to the behavior explicitly prescribed by the Skill. There is no evidence that these records are transmitted to an external party. ### Attack Path 1. A user discusses confidential or personal information in a conversation or supplies it in a report. 2. One of the Skill's broad detection rules classifies the content as a deadline, stakeholder, commitment, issue, context item, or another supported recor ...[truncated 1216 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user opt-in before enabling automatic persistence and provide per-record confirmation for sensitive categories. 2. Do not retain raw `source_text` by default. Store a minimal summary, or make raw-source retention an explicit option. 3. Redact credentials, API keys, tokens, private keys, personal data, financial information, and other sensitive patterns before writing records. 4. Create the storage directory and files with owner-only permissions, such as directory mode `0700` and file mode `0600`, rather than relying on the environment's default `umask`. 5. Encrypt records at rest using a key managed separately from the record directory when sensitive content must be retained. 6. Add configurable retention periods, automatic expiration, record deletion, complete data export, and secure purge controls. 7. Allow users to exclude conversations, sources, topics, and record categories from collection. 8. Document the precise storage behavior, threat model, backup implications, and access-control requirements before activation. 9. Add tests verifying secret redaction, permission enforcement, retention behavior, and suppression of records when consent has not been granted.