T09 · Insecure Skill Coding Practices
- Location
references/system-rca.md:45- Finding
Unredacted Payload and Session Metadata Exposure in Debugging Guidance
- Content
View full analysis
Vulnerability Details
File Location:
references/system-rca.md, lines 45–52
Vulnerability Type: Sensitive information exposure through diagnostic logs and tool results
Risk Level: MediumComplete Vulnerable Snippet:
markdown ### Step 3: Insert Probes BEFORE modifying any behavior, insert probes to collect evidence: | Probe Type | Location | What to Log | |-----------|----------|-------------| | Log | Each edge | `[EdgeN] from=X to=Y payload={...}` | | Return field | Tool result | `{ ..., debug: { sessionId, url } }` | | Metric | Critical path | Latency, success rate | | Assertion | Invariant points | `assert(sessionId != null)` |Technical Analysis
The Skill instructs the Agent to insert probes at every edge of a system-level data flow and log the complete payload. Cross-layer payloads may contain authorization headers, cookies, API keys, access tokens, passwords, user prompts, personal information, or other application secrets.
The guidance also recommends returning a real
sessionIdand URL in tool output. This unnecessarily propagates internal identifiers and endpoint details into Agent-visible results, chat transcripts, test artifacts, or other retained output.No safeguards require field allowlisting, recursive redaction, URL sanitization, production restrictions, access controls, retention limits, or removal of temporary probes. This conflicts with least-data diagnostic practices and creates an avoidable information-disclosure risk.
Attack Path
- A bug occurs in an authenticated request, streaming connection, or other cross-layer workflow.
- Following the mandatory RCA process, the Agent inserts diagnostic probes at each system edge.
- A probe records the entire payload, including any secrets, cookies, tokens, or personal data it contains.
- The Agent also adds real session identifiers and URLs to returned tool results.
- These values persist in application l ...[truncated 1264 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace complete-payload logging with an explicit allowlist of fields required for the current diagnosis.
-
Require recursive masking or omission of:
Authorizationand proxy-authorization headers- Cookies and
Set-Cookievalues - Passwords, secrets, API keys, and access or refresh tokens
- Session identifiers, CSRF tokens, and signed URLs
- Personal, financial, health, and other regulated data
-
Use a newly generated correlation ID instead of exposing the actual
sessionId. -
Sanitize URLs by removing user information, sensitive query parameters, fragments, and signed access parameters.
-
Prohibit verbose payload probes in production unless explicitly approved and protected by restricted log access.
-
Apply short retention periods and access controls to diagnostic artifacts.
-
Require temporary probes to be removed or disabled immediately after reproduction and verification.
-
Add a safe diagnostic example, such as:
text [EdgeN] from=frontend to=backend requestId=<generated-id> eventType=<allowlisted-value> payloadKeys=<field-names-only> -
Add a mandatory pre-logging review that checks whether each recorded field is necessary and non-sensitive.
-