T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/add_deadline.py:9
- Finding
- Immigration deadline records are stored with ambient filesystem permissions## Vulnerability Details **File Location**: `scripts/add_deadline.py`, lines 9-24 **Vulnerability Type**: Plaintext sensitive-data storage with insufficient permission enforcement **Risk Level**: Medium ### Vulnerable Code ```python IMMIGRATION_DIR = os.path.expanduser("~/.openclaw/workspace/memory/immigration") DEADLINES_FILE = os.path.join(IMMIGRATION_DIR, "deadlines.json") def ensure_dir(): os.makedirs(IMMIGRATION_DIR, exist_ok=True) def load_deadlines(): if os.path.exists(DEADLINES_FILE): with open(DEADLINES_FILE, 'r') as f: return json.load(f) return {"deadlines": []} def save_deadlines(data): ensure_dir() with open(DEADLINES_FILE, 'w') as f: json.dump(data, f, indent=2) ``` ### Technical Analysis Deadline titles, descriptions, application identifiers, and immigration-related dates are written to an unencrypted JSON file. The directory and file are created without explicit owner-only permission modes, so their effective permissions depend on the process umask and any pre-existing filesystem permissions. On a shared system with a permissive umask or accessible home directory, the resulting file may be readable by other local users. The implementation also does not verify that the destination is a regular file owned by the current user before opening it. ### Attack Path 1. A user runs `add_deadline.py` and records an immigration deadline. 2. The script creates the directory and `deadlines.json` using ambient filesystem permissions. 3. On a permissively configured shared system, another local account traverses the directory and reads the JSON file. 4. The attacker obtains deadline descriptions, dates, priorities, and linked application identifiers. ### Impact Assessment The vulnerability may disclose private immigration timelines and application-related metadata to another local user. It does not grant remote access, code execution, elevated pr ...[truncated 182 chars]
- Remediation
- ## Remediation Suggestions - Create `memory/immigration` with owner-only mode `0o700`. - Create record files with mode `0o600`, using `os.open()` with explicit creation flags and permissions. - Verify that existing destinations are regular files owned by the current user and reject symbolic links. - Write updates to an owner-only temporary file in the same directory, flush and synchronize it, and atomically replace the destination with `os.replace()`. - Apply restrictive permissions to existing directories and files during migration. - Document that records are stored locally in plaintext and provide a secure deletion workflow.