T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/add_cpa_question.py:16- Finding
Sensitive tax records are created without restrictive filesystem permissions
- Content
View full analysis
None: os.makedirs(BASE_DIR, exist_ok=True) def load_questions() -> Dict[str, Any]: if os.path.exists(QUESTIONS_FILE): with open(QUESTIONS_FILE, "r", encoding="utf-8") as f: return json.load(f) return {"questions": []} def save_questions(data: Dict[str, Any]) -> None: ensure_base_dir() with open(QUESTIONS_FILE, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) ``` The same creation pattern is used by the other listed scripts for tax documents, expenses, notices, annual state, and generated summaries. ### Technical Analysis The application stores sensitive tax and financial records in the predictable directory `~/.openclaw/workspace/memory/tax/`. It creates the directory with `os.makedirs()` and writes files with ordinary `open(..., "w")` calls, but it does not set or verify restrictive permission modes. Consequently, permissions are determined by the process umask. Under a common umask of `0022`, directories can be created with mode `0755` and files with mode `0644`. On a multi-user system, these modes may allow other local users to traverse the tax-memory directory and read files containing: - Tax document types, issuers, and amounts - Expense amounts and descriptions - Tax-authority notice summaries and deadlines - CPA questions and linked records - Raw natural-language input - Generated Markdown and CSV handoff reports The issue does ...[truncated 1359 chars]- Remediation
View remediation