T09 · Insecure Skill Coding Practices
- Location
SKILL.md:24- Finding
Sensitive Health Information Stored in Plaintext CSV Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24-72
Vulnerability Type: Plaintext storage of sensitive health data
Risk Level: MediumVulnerable Code Snippet
bash node scripts/health_record.js morning --weight=70 --sleep=7 --mood=4 --hr=60 node scripts/health_record.js night --weight=69.5 --mood=3 node scripts/health_record.js water --amount=500 --source=water node scripts/health_record.js workout --activity=running --duration=30 --intensity=3 --cal=300text data/daily.csv: ts,date,weight_kg,sleep_hours,resting_hr,mood_1to5,notes data/hydration.csv: ts,date,time,amount_ml,source,notes data/workout.csv: ts,date,time,activity,duration_min,intensity_1to5,calories_estimate,notes data/nutrition_meals.csv: ts,date,time,meal_type,description,photo_ref,cal,p,c,f,water,notesTechnical Analysis
The documented workflow stores weight, sleep duration, resting heart rate, mood, hydration, exercise, meal descriptions, free-form notes, and food-photo references in CSV files under the project-local
datadirectory.CSV files provide no encryption or access control by themselves. The skill documentation does not require restrictive file permissions, encryption at rest, data minimization, retention limits, deletion controls, consent before retaining photo references, or safeguards preventing the generated files from being committed to version control.
The referenced implementation scripts are absent from the audited artifact, so implementation-level protections cannot be verified. Based on the documented design, sensitive health records are intended to be persisted as plaintext CSV data.
Attack Path
- A user invokes the documented health-recording commands.
- Health and behavioral information is written to files such as
data/daily.csvanddata/nutrition_meals.csv. - The files accumulate sensitive records, including timestamps, health measurements, notes, meal information, and photo references.
- A local user, pro ...[truncated 1058 chars]
- Remediation
View remediation
Remediation Suggestions
- Store health records outside the project and source-code directories in a dedicated per-user data location.
- Create directories with owner-only permissions and files with restrictive permissions, such as
0700for directories and0600for files on supported systems. - Encrypt sensitive records at rest using authenticated encryption and keep encryption keys outside the data directory.
- Add
data/, generated CSV files, photo references, and local secrets to.gitignore; also configure automated secret and sensitive-data checks before commits. - Minimize retained information. Avoid storing photo references and free-form notes unless explicitly necessary and approved by the user.
- Obtain explicit user consent before persistence, clearly identifying what data will be stored, where it will be stored, and for how long.
- Implement configurable retention periods and commands for reviewing, exporting, and securely deleting stored records.
- Avoid publishing health records to shared channels by default. Verify channel visibility and request confirmation before posting sensitive information.
- Validate the missing recording scripts in a follow-up audit to confirm that they enforce permissions, safely encode CSV fields, prevent formula injection, and do not transmit health data externally.