T09 · Insecure Skill Coding Practices
- Location
references/auth-setup.md:82- Finding
Credential Files Are Stored Without Enforced Restrictive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
references/auth-setup.md, lines 46 and 82–96
Vulnerability Type: Insecure local credential storage
Risk Level: MediumComplete Vulnerable Snippet
text 5. Download the JSON file and store it securely (e.g., `~/.config/seo-geo-skill/service_account.json`)bash mkdir -p ~/.config/seo-geo-skilltext Save to `~/.config/seo-geo-skill/google-api.json`:json { "service_account_path": "~/.config/seo-geo-skill/service_account.json", "api_key": "<GOOGLE_API_KEY>", "default_property": "sc-domain:example.com", "ga4_property_id": "properties/123456789" }Technical Analysis
The setup instructions place an API key and a service-account JSON file under the user's home directory but do not enforce restrictive permissions on either the directory or the files. A Google service-account JSON file contains a private key, while
google-api.jsoncontains an API key and the path to that private key.The command
mkdir -papplies permissions according to the user's current umask. It does not guarantee that the directory is accessible only by its owner. Likewise, files created by an editor, redirection, or another setup process may be group-readable or world-readable under a permissive umask.This issue does not itself transmit credentials to an unrelated endpoint. The Skill's network access is directed toward documented Google APIs and is necessary for its declared SEO functionality. The weakness is the lack of local access-control hardening around those credentials.
Attack Path
- A user follows the documented setup and creates
~/.config/seo-geo-skill. - The user saves
google-api.jsonand the service-account JSON file without explicitly setting permissions. - The system or account has a permissive umask, shared home directory, backup exposure, or another local account capable of reading those files.
- The attacker obtains the API key or service-account private ...[truncated 1420 chars]
- A user follows the documented setup and creates
- Remediation
View remediation
Remediation Suggestions
Create the credential directory with owner-only access:
bash install -d -m 700 ~/.config/seo-geo-skillAfter creating the configuration and service-account files, explicitly restrict them:
bash chmod 600 ~/.config/seo-geo-skill/google-api.json chmod 600 ~/.config/seo-geo-skill/service_account.jsonThe setup guide should also:
- Instruct users to verify permissions with
statorls -l. - Recommend restricting API keys to the minimum required APIs and, where feasible, applicable client restrictions.
- Use separate service accounts for read-only Search Console and GA4 reporting versus Indexing API operations.
- Avoid granting Search Console Owner access unless the user explicitly needs eligible Indexing API operations.
- State that the service account should receive no project-level IAM roles unless independently required.
- Recommend credential rotation after suspected exposure.
- Warn against committing either JSON file to version control, placing it in shared directories, or including it in unencrypted backups.
- Prefer a managed secret store or short-lived credentials where the deployment environment supports them.
- Instruct users to verify permissions with