T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily_briefing_orchestrator.sh:10- Finding
Personal briefing data is written to predictable, insufficiently protected temporary files
- Content
View full analysis
/dev/null || true exit 0 fi ``` ```bash } >"$OUT" 2>/dev/null # Atomic publish cp -f "$OUT" "${CANON}.tmp" && mv -f "${CANON}.tmp" "$CANON" ``` ### Technical Analysis The orchestrator writes the aggregated daily briefing to the system-wide `/tmp` directory without first setting a restrictive `umask`, creating a private directory, or explicitly applying permissions such as `0600`. The generated JSON may contain: - Contact names and email addresses - Birthdays - Calendar event titles and times - Reminder titles and due dates - Email senders, subjects, and previews - Location and timezone information The per-run filename includes a timestamp, process ID, and shell pseudorandom value, but it is still created directly in a shared directory and remains present after successful publication. The cleanup handler only runs when the script is explicitly invoked with `--cleanup`. The canonical staging path `/tmp/daily_briefing_data.json.tmp` is completely predictable. Because `cp -f` generally follows an existing symbolic link at the destination, another local process may pre-create that path as a symlink. If the invoking user has permission to write to the symlink target, briefing content may be written to an unintended file before the subsequent `mv`. No evidence indicates that these files are deliberately transmitted to an unrelated external service. The principal risk is local disclosure and unsafe filesystem interaction. ### Att ...[truncated 1226 chars]- Remediation
View remediation