T09 · Insecure Skill Coding Practices
- Location
scripts/join-botland.sh:27- Finding
BotLand Credentials Stored and Printed Without Adequate Protection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/join-botland.sh, lines 27-35 and 116-129
Vulnerability Type: Plaintext credential storage and disclosure
Risk Level: MediumVulnerable Code
bash mkdir -p "$DATA_DIR" CRED_FILE="$DATA_DIR/botland-credentials.json" if [[ -f "$CRED_FILE" ]]; then echo "✅ Already registered. Credentials at: $CRED_FILE" cat "$CRED_FILE" exit 0 fibash cat > "$CRED_FILE" <<JSON { "citizenId": "$CITIZEN_ID", "handle": "$HANDLE", "password": "$PASSWORD", "accessToken": "$ACCESS_TOKEN", "refreshToken": "$REFRESH_TOKEN", "registeredAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)", "name": "$NAME", "species": "$SPECIES" } JSONTechnical Analysis
The script stores the account password, access token, and refresh token in a plaintext JSON file. It does not establish a restrictive
umask, explicitly set the file to mode600, or ensure that the containing directory is mode700.The resulting permissions therefore depend on the caller's environment and current
umask. Under an overly permissive configuration, other local users or processes may be able to read reusable authentication secrets.If the credential file already exists, the script also prints its entire contents with
cat. This can expose credentials through:- Terminal or shell-session recording
- CI/CD job logs
- Agent transcripts and tool-call output
- Centralized logging or monitoring
- Output captured by a parent process
The behavior exceeds what is necessary to tell an operator that registration has already occurred. Only the credential path and non-sensitive identity information need to be displayed.
Attack Path
- A victim runs
join-botland.shin an environment with permissive file permissions or captured command output. - The script writes the password, access token, and refresh token into
botland-credentials.json. - A local ...[truncated 1011 chars]
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive umask before creating the data directory or credential file:
bash umask 077 -
Create the credential directory with explicit permissions:
bash install -d -m 700 "$DATA_DIR" -
Write credentials atomically to a temporary file created in the same protected directory, apply mode
600, and then rename it:bash TMP_FILE=$(mktemp "$DATA_DIR/.botland-credentials.XXXXXX") chmod 600 "$TMP_FILE" cat > "$TMP_FILE" <<JSON { "citizenId": "$CITIZEN_ID", "handle": "$HANDLE", "password": "$PASSWORD", "accessToken": "$ACCESS_TOKEN", "refreshToken": "$REFRESH_TOKEN" } JSON mv -f "$TMP_FILE" "$CRED_FILE" -
Add a trap to remove an incomplete temporary file if registration fails.
-
Never print the complete credential file. On repeat execution, display only the path, citizen ID, and handle.
-
Prefer an operating-system credential store or the official CLI's protected configuration mechanism instead of a custom plaintext file.
-
Document token revocation and rotation procedures in case the file or command output is exposed.
-