T09 · Insecure Skill Coding Practices
Warning
- Location
- skills/smyx_common/scripts/util.py:326
- Finding
- Authentication Tokens Are Persisted in an Unencrypted SQLite Database<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:326-348`; `skills/smyx_common/scripts/dao.py:64-69, 326-333` **Vulnerability Type**: Plaintext storage of authentication credentials **Risk Level**: Medium ### Vulnerable Code ```python found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` The database is created as a regular workspace file: ```python parent_dir = os.path.join(workspace, "data") FileUtil.mkdir(parent_dir) db_path = os.path.join(parent_dir, db_path) return db_path ``` The token values are ordinary plaintext columns: ```python token = Column(String(500), comment="token") open_token = Column(String(1000), comment="open token") ``` ### Technical Analysis After the remote login or registration operation returns authentication credentials, the Skill adds the `token` and `openToken` values to a user model and stores that model in `data/smyx-common-claw.db`. SQLite provides no encryption at rest by default. The implementation does not apply field-level encryption, use an operating-system credential manager, explicitly restrict database file permissions, define a token retention period, or delete credentials after the analysis completes. Consequently, the credentials re ...[truncated 1542 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid persistent token caching unless it is required. Keep tokens in process memory and discard them when execution ends. 2. If persistence is necessary, use an operating-system credential manager or a dedicated secrets-management service rather than SQLite plaintext columns. 3. Apply authenticated encryption to token fields, with encryption keys stored separately from the database. 4. Create the database and its parent directory with owner-only permissions, such as `0700` for the directory and `0600` for the file on POSIX systems. 5. Use short-lived, narrowly scoped tokens and refresh tokens through a separate protected mechanism. 6. Define and enforce token expiration, retention, deletion, and revocation procedures. 7. Do not include credentials in workspace backups unless those backups are encrypted and access-controlled. 8. Add tests that verify tokens are not recoverable as plaintext from the database file. ]]>