T09 · Insecure Skill Coding Practices
- Location
SKILL.md:233- Finding
Mandatory Persistent Storage of Potentially Sensitive Research Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 233-241
Vulnerability Type: Unconditional persistence of sensitive research metadata in plaintext
Risk Level: MediumVulnerable Code
markdown ### 阶段 6：记忆归档（必做） 完成后**必须**写入 `memory/YYYY-MM-DD.md`： - 报告主题、研究边界 - 飞书链接（如有） - 核心发现摘要 - 数据来源汇总 - [来源] 标注是谁发起的研究 - （多角色模式）风控评级 + CIO 决策摘要一句话Technical Analysis
The Skill requires every completed research task to be recorded in a persistent Markdown file, irrespective of whether the user requested or consented to retention. The required record can contain:
- The research subject and scope
- Core due-diligence findings
- Data-source information
- The identity or attribution of the requester
- A link to an externally stored Feishu document
- Investment risk ratings and CIO decision summaries
Company due diligence can involve non-public commercial information, investment strategy, holdings-related context, and personally attributable request metadata. Persisting this information in a predictable plaintext path increases its lifetime and exposure beyond the active session.
The instruction does not require sensitivity classification, redaction, restrictive file permissions, user consent, retention limits, secure deletion, or authorization checks before later access. This is best classified as an insecure data-handling practice rather than agent memory poisoning: the retained content consists of research metadata and conclusions, not attacker-controlled behavioral instructions intended to alter future agent behavior.
Attack Path
- A user requests confidential company research, investment analysis, or due diligence.
- The Skill processes potentially non-public or commercially sensitive information.
- Upon completion, the mandatory archival stage writes the topic, findings, requester attribution, document link, and investment decision metadata to
memory/YYYY-MM-DD.md. - The plaintext record remains available after the active tas ...[truncated 1110 chars]
- Remediation
View remediation
Remediation Suggestions
-
Make archival explicitly opt-in
- Do not write any persistent record unless the user has affirmatively requested it.
- Present the exact fields to be stored before requesting consent.
-
Default to no persistence for sensitive work
- Disable archival by default for due diligence, non-public company information, personal data, portfolio details, and investment decisions.
- Provide an explicit ephemeral or no-memory mode.
-
Apply data minimization
- Store only the minimum operational metadata required.
- Exclude requester identity, holdings information, risk ratings, CIO decisions, and external document links by default.
- Redact confidential names and identifying details.
-
Classify content before writing
- Add checks for non-public information, personal data, financial information, credentials, access-bearing URLs, and confidential business material.
- Block persistence or require renewed consent when sensitive content is detected.
-
Protect retained records
- Use a dedicated storage location with restrictive permissions and per-user access isolation.
- Avoid predictable shared plaintext files where practical.
- Encrypt sensitive records at rest if retention is genuinely required.
-
Define lifecycle controls
- Establish a short retention period appropriate to the task.
- Support user-visible review and deletion.
- Securely remove expired records and document the retention policy.
-
Sanitize external links
- Do not persist Feishu or other document URLs containing access tokens or sensitive identifiers.
- Store a non-access-bearing document identifier only when necessary and authorized.
-