T09 · Insecure Skill Coding Practices
- Location
SKILL.md:121- Finding
Automatic Plaintext Persistence of Sensitive User Location and Preference Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 121–149 and 309–312
Vulnerability Type: Plaintext storage and reuse of privacy-sensitive user data
Risk Level: MediumVulnerable Code Snippet
markdown 激活技能后，**第一件事**是检查记忆然后询问： **首次使用（无记忆）：** > "帮您找附近好外卖 🍜 请问您现在在哪？（街道/小区/地标都可以）另外有没有菜系或预算偏好？没有的话我直接推荐综合好评 Top 5~" **有历史记忆：** > "帮您找附近好外卖 🍜 还是上次的 {地址} 吗？上次您偏好 {菜系}，这次还来这类，还是换换口味？" - 如果用户只给地址、没提偏好 → 直接搜索推荐，省一轮对话 - 地址模糊时追问具体地标 - 接受格式：街道地址、小区名、商圈名、地标建筑名 **地址与口味偏好记忆机制：** 搜索完成后，向 `~/.workbuddy/MEMORY.md` 写入/更新以下两项持久记忆：外卖偏好
- 常用地址：{地址}
- 口味偏好：{菜系偏好 / 忌口 / 预算范围 / 其他偏好}
text - **地址记忆**：下次激活时，若存在常用地址，优先询问："还是上次的 {地址} 吗？" - **口味偏好记忆**：下次激活时，若存在口味偏好，在询问中自动带上："上次您偏好 {菜系}，这次还来这类吗？" - **偏好更新时机**：每次点餐结束后，若用户表达了新的菜系偏好、忌口、预算习惯，更新口味偏好条目The Skill also stores ordering history:
markdown 如果用户回复了选了哪家，写入记忆：text ## 外卖偏好 - 最近一次点单：{商家名}（{日期}）Technical Analysis
The Skill instructs the agent to read persistent memory as its first action and automatically write the user's address, dietary restrictions, budget, preferences, and ordering history to
~/.workbuddy/MEMORY.md. These fields can reveal a likely home or workplace location, health- or religion-related dietary information, spending patterns, and behavioral history.The design provides no explicit opt-in requirement, data minimization rule, expiration period, deletion mechanism, encryption requirement, or restrictive file-permission requirement. It also directs the agent to repeat saved address and preference information in later sessions. Because the memory file is shared persistent state rather than session-local storage, other Skills, local processes, or unintended participants in a later conversation may be able to retrieve or expose this information.
This is not classified as agent memory poisoning because the stored content is user profile data rather than attacker-controlled instructions intended to alter future agent behavior. The best matching classification ...[truncated 1695 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require explicit opt-in
- Ask whether the user wants the address or preferences saved before writing persistent memory.
- Keep storage session-only by default.
- Treat consent for location, preferences, and ordering history as separate choices.
-
Minimize retained information
- Store a user-selected alias such as “office area” instead of a full address.
- Prefer a coarse district or business area where precise location is unnecessary.
- Do not retain ordering history unless it is required and separately authorized.
-
Protect stored data
- Use a dedicated structured store rather than a shared general-purpose Markdown file.
- Apply restrictive owner-only file permissions.
- Use platform-provided encrypted storage where available.
- Ensure unrelated Skills cannot read this Skill's private state.
-
Add lifecycle controls
- Define a short expiration period.
- Allow users to inspect, update, and delete saved data.
- Automatically remove obsolete locations and ordering records.
-
Prevent conversational disclosure
- Do not repeat a complete saved address automatically.
- Use a masked or aliased location and require confirmation before revealing details.
- Reconfirm the user's identity or session context before using persistent location data.
-
Constrain memory access
- Read only the Skill-specific memory namespace.
- Never interpret stored preference fields as executable instructions.
- Validate and length-limit all values before persistence.
-