T09 · Insecure Skill Coding Practices
- Location
SKILL.md:34- Finding
Potential Plaintext Persistence of Sensitive Conversation Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 34-52
Vulnerability Type: Sensitive data stored in persistent memory without mandatory redaction controls
Risk Level: MediumEvidence
The operative skill instructions require the agent to extract configuration values, addresses, endpoints, file paths, and other conversation data into a persistent memory file. Translated from the source instructions:
markdown ### Phase 2 — Extract Memory 1. Extract information worth persisting from tool output and the conversation: - Newly discovered facts: addresses, configuration values, endpoints, file paths - Decisions and reasons: why option A was selected instead of option B - Errors and solutions: troubleshooting records - User preferences: explicitly stated preferences or requirements - Task progress: what has been completed and what remains 2. Append the extracted information to `memory/YYYY-MM-DD.md` - Use `edit` in append mode and never overwrite existing content - Attach a brief source description to each memory itemRelated rules in
SKILL.md, lines 87-96, prioritize retaining configuration, addresses, endpoints, and other important information:markdown ### Mandatory Rules - Never discard important information that has not been recorded: saving too much is preferable to omitting information. - Append-only writes: only append to memory files and never overwrite them. ### Information Classification - Must save: important configurations, addresses and endpoints, file paths, and error solutions - Should save: decision reasons, user preferences, and task progressREADME.md, lines 75-84 and 132-138, claims that sensitive information will be redacted, but the operativeSKILL.mddoes not define a mandatory redaction algorithm, secret-detection procedure, validation step, or list of prohibited data classes. The README also presents login credentials a ...[truncated 2431 chars]- Remediation
View remediation
Remediation Suggestions
- Add mandatory exclusions to
SKILL.mdfor passwords, API tokens, session cookies, authorization headers, private keys, recovery codes, personal data, and secret-bearing environment variables. - Require deterministic secret scanning before every memory write, covering common token formats, key blocks, credentials embedded in URLs, and sensitive configuration keys.
- Replace detected values with non-reversible placeholders such as
[REDACTED_API_TOKEN]; do not retain partial values that could facilitate reconstruction. - Require the agent to show the proposed memory entries and obtain explicit user approval before persisting any item containing configuration or access information.
- Apply data minimization by storing only the fact necessary for task continuity, such as “service authentication was configured,” rather than the credential itself.
- Remove login credentials from the “must save” examples and make
README.mdconsistent with the enforceable instructions inSKILL.md. - Define restrictive permissions, retention limits, deletion controls, and access boundaries for the
memorydirectory. - Add a post-write verification step that scans the persisted entry and removes it immediately if sensitive data is detected.
- Add mandatory exclusions to