T09 · Insecure Skill Coding Practices
- Location
SKILL.md:353- Finding
Automatic Archival of Potentially Sensitive User Decision Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:353-366
Vulnerability Type: Persistent storage of potentially sensitive user content without explicit consent or retention controls
Risk Level: MediumVulnerable Configuration
The following is an English rendering of the relevant configuration:
markdown - The `Read` tool may only read: - Files in the Skill directory (`SKILL.md`, `references/`, `docs/`, etc.) - `~/.openclaw/workspace/tmp_mmc_*.md` temporary report files - Reading hidden files under the user's home directory, such as `.ssh/`, `.env/`, and `.aws/`, is strictly prohibited. - The `Write` tool may only write: - `~/.openclaw/workspace/memory/` for report archival - `~/.openclaw/workspace/tmp_mmc_*.md` for temporary report files - `~/Desktop/*` for final report output - Writing to any other path is prohibited. - Maximum execution time for each child session: 120 seconds - Maximum concurrent child sessions: 6 - Automatic report archive path: `~/.openclaw/workspace/memory/MONTHLY/mmd_<date>.md`Technical Analysis
The Skill collects the user's project background, requirements, and proposal under review and incorporates that information into a consensus report. It then specifies an automatic archive location under the Agent's persistent workspace memory.
Decision submissions may contain confidential business plans, financial information, personal data, internal architecture details, or credentials accidentally pasted by a user. The Skill does not require explicit consent before archival and does not define data classification, secret detection, redaction, file permissions, retention duration, deletion, or per-user isolation.
The issue is classified as insecure persistent handling of sensitive data rather than Agent Memory Poisoning. The archived material consists primarily of reports rather than attacker-controlled behavioral rules, so there is ins ...[truncated 1739 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable report archival by default and return reports only in the current conversation.
- Require explicit, informed user confirmation before writing any report to persistent storage.
- Show the exact destination path and explain that the report may remain accessible across sessions.
- Scan reports for credentials, tokens, private keys, passwords, personal data, and other sensitive fields before persistence.
- Redact or omit the original proposal and unnecessary background information from archived reports.
- Store reports in a dedicated data directory rather than an Agent behavioral-memory directory.
- Apply restrictive file and directory permissions and enforce separation between users and workspaces.
- Define a short retention period and automatically delete expired reports and temporary files.
- Provide commands to list, export, and permanently delete archived reports.
- Document whether report content is forwarded to external model providers and obtain separate consent where applicable.
- Remove automatic archival entirely if persistence is not necessary for the Skill's consensus functionality.