T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:103
- Finding
- Unsafe Deletion and Modification of Persistent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 103-110 **Vulnerability Type**: Uncontrolled persistent-data deletion **Risk Level**: High **Relevant source instructions, rendered in English:** ```markdown ### Stage 4: Task Termination and Distillation 1. Status modification: Change the task label from ACTIVE to ARCHIVED and move it from MEMORY_INDEX_ACTIVE.md to MEMORY_INDEX_ARCHIVED.md. 2. Memory distillation: Open the corresponding Layer 3 task file and delete all lengthy and useless process logs, including scratchpads and minor bug trial-and-error records. 3. Token release: Minimize the archived file so that future retrieval consumes as little context as possible. ### System Maintenance - Heartbeat orphan reconciliation: During idle heartbeat cycles, periodically compare physical files under /memory/topics/* with the ACTIVE index and register or clean up unregistered orphan files. ``` ### Technical Analysis The Skill authorizes an Agent to delete historical process data and “clean up” files that are not registered in the active index. It does not define ownership checks, canonical path validation, a retention period, backup requirements, soft deletion, transactional updates, or mandatory user confirmation. Absence from an index is not sufficient evidence that a file is disposable. A legitimate file may be temporarily unindexed because of interrupted updates, concurrent Agent activity, index corruption, manual user changes, or migration between states. The instruction to delete allegedly unnecessary process history also removes information that may be required for auditing, incident investigation, or recovery. The earlier cold-start workflow additionally permits inspection of recent general memory journals. This gives the Skill access to context that may be unrelated to the task it is managing. ### Attack Path 1. A legitimate topic file is created manually, by another Agent, or during an interrupted in ...[truncated 1119 chars]
- Remediation
- ## Remediation Suggestions - Restrict all modifications to a dedicated, canonicalized, Skill-owned directory. - Require explicit user confirmation before deleting any file or removing historical content. - Replace permanent deletion with soft deletion into a quarantine directory. - Create versioned backups before archive compaction or reconciliation. - Attach verifiable ownership and lifecycle metadata to every managed file. - Treat unindexed files as recovery candidates, not deletion candidates. - Use transactional index updates so file creation and index registration cannot diverge. - Define deterministic retention rules rather than allowing the Agent to decide what is “useless.” - Preserve an append-only audit trail recording the file, operation, timestamp, and authorization. - Detect concurrent modification before writing or deleting a file.