T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:17
- Finding
- Session Transcripts Sent to a Third-Party Embedding Provider Without Privacy Safeguards## Vulnerability Details **File Location**: `SKILL.md`, lines 17–24 **Vulnerability Type**: External processing of potentially sensitive session data through an insecure default configuration **Risk Level**: Medium **Vulnerable Code Snippet**: ```json { "memorySearch": { "enabled": true, "provider": "voyage", "sources": ["memory", "sessions"], "indexMode": "hot", "minScore": 0.3, "maxResults": 20 } } ``` The associated provider documentation at lines 123–129 confirms that Voyage is an API-backed provider: ```markdown ### Provider errors? - Voyage: Set `VOYAGE_API_KEY` in environment - OpenAI: Set `OPENAI_API_KEY` in environment - Use `local` provider if no API keys available ``` ### Technical Analysis The recommended configuration enables real-time indexing of both persistent memory and historical session transcripts while selecting Voyage, an external embedding provider. As a result, transcript content may cross the local trust boundary for embedding generation. Session transcripts can contain personal information, credentials, authentication tokens, proprietary material, internal decisions, or other confidential data. The Skill does not require explicit consent before enabling remote transcript processing, identify the data transmitted, require secret redaction, limit which sessions are indexed, or establish retention and access-control requirements. Although a local provider is mentioned as an alternative, it is not the recommended privacy-preserving default. This issue does not grant operating-system privileges or execute arbitrary code. It creates a confidentiality and data-governance risk affecting any content included in the configured `sessions` and `memory` sources. ### Attack Path 1. A user copies the recommended configuration into `clawdbot.json` or `moltbot.json`. 2. The memory subsystem enables hot indexing with `sources` set to both `memory` and `sessi ...[truncated 1070 chars]
- Remediation
- ## Remediation Suggestions 1. Use a privacy-preserving default configuration: ```json { "memorySearch": { "enabled": true, "provider": "local", "sources": ["memory"], "indexMode": "hot", "minScore": 0.3, "maxResults": 20 } } ``` 2. Require explicit, informed opt-in before enabling the `sessions` source with any remote provider. 3. Clearly document which data is transmitted, the destination provider, applicable retention behavior, and relevant access controls. 4. Add secret detection and redaction for credentials, tokens, private keys, personal data, and other sensitive values before remote embedding requests. 5. Permit users to select specific sessions, directories, or data classes rather than indexing all available transcript history. 6. Recommend least-retention settings and provide procedures to remove indexed data from both local indexes and remote systems where supported. 7. Warn users not to place credentials or highly sensitive information in indexed memory files or sessions. 8. Retain remote providers as optional configurations for users who have reviewed and accepted the associated privacy and compliance implications.