T09 · Insecure Skill Coding Practices
Warning
- Location
- references/portfolio-current.md:3
- Finding
- Plaintext User Financial Portfolio Embedded in the Skill Package## Vulnerability Details **File Location**: `references/portfolio-current.md`, lines 3-17 **Vulnerability Type**: Plaintext sensitive financial data exposure **Risk Level**: Medium ### Evidence ```markdown 更新时间: 2026-03-06 金额单位: 按用户输入原值 ## 明细 1. 南方原油LOF-A: 113.39 2. 国投瑞银白银期货LOF-A: 157.67 3. 华夏有色金属ETF联接A: 96.38 4. 永赢高端装备智选A: 92.10 5. 嘉实上证科创板芯片ETF联接C: 93.71 ## 组合结构快照 - 总金额: 553.25 - 原油+白银+有色(商品相关): 367.44 (66.41%) - 装备+芯片(科技制造相关): 185.81 (33.59%) ``` ### Technical Analysis The distributed Skill package embeds a user-specific portfolio in a static plaintext reference file. The exposed information includes named holdings, exact amounts, total portfolio value, allocation percentages, and an update date. This data is not required to be permanently bundled with the Skill. The declared workflow in `SKILL.md` calls for confirming personalization inputs when the Skill is first used and retaining them in session memory. Shipping a populated portfolio file therefore exceeds the minimum data retention necessary for the reporting functionality. No credentials, executable payload, or automated exfiltration mechanism was identified. Exploitation requires an actor to obtain read access to the Skill package or a copy of it. ### Attack Path 1. A user installs, publishes, shares, archives, or backs up the Skill package with the populated portfolio file intact. 2. An attacker or unintended recipient obtains read access to that package through repository access, package distribution, backup exposure, or local filesystem access. 3. The actor opens `references/portfolio-current.md`. 4. The actor recovers the user's named investments, exact balances, total value, allocation concentrations, and snapshot date. 5. The information may then be used for financial profiling, targeted social engineering, or investment-themed phishing. This issue does not independently grant system privileges, code execution, account access, or access to additional files. ### Impact Assessment Th ...[truncated 378 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all populated user-specific holdings, balances, allocation percentages, totals, and dates from the distributed Skill package. 2. Replace `references/portfolio-current.md` with an empty schema or synthetic example containing no real user data. 3. Collect portfolio information only at runtime and retain it in session-scoped memory by default. 4. If cross-session persistence is required, obtain explicit user consent and store the data in access-controlled, encrypted application storage rather than a package reference file. 5. Apply data minimization by storing only fields necessary for the requested report. 6. Provide controls for users to inspect, update, and delete persisted portfolio data. 7. Add release checks or secret/sensitive-data scanning to prevent populated portfolio files from being packaged or committed. 8. Restrict filesystem permissions for any locally persisted financial data and avoid including it in logs, archives, diagnostics, or shared exports.