T09 · Insecure Skill Coding Practices
Error
- Location
api.js:5- Finding
Tenant Access Token Stored in an Unprotected Shared Plaintext Cache
- Content
View full analysis
now) { tokenCache.token = saved.token; tokenCache.expireTime = expiry; } } catch (e) { // Ignore corrupted cache } } ``` ```javascript tokenCache.token = data.tenant_access_token; tokenCache.expireTime = now + data.expire - 60; try { const cacheDir = path.dirname(TOKEN_CACHE_FILE); if (!fs.existsSync(cacheDir)) { fs.mkdirSync(cacheDir, { recursive: true }); } fs.writeFileSync(TOKEN_CACHE_FILE, JSON.stringify({ token: tokenCache.token, expire: tokenCache.expireTime }, null, 2)); } catch (e) { console.error("Failed to save token cache:", e.message); } ``` ### Technical Analysis The Skill writes a Feishu tenant access token to `../../memory/feishu_token.json` as plaintext. The comment states that this cache is shared with other Feishu Skills. The file is created without an explicit restrictive mode, ownership checks, symlink checks, or an atomic file-creation strategy. A tenant access token is a bearer credential. Any process able to read it can submit authenticated Feishu API requests with the permissions granted to the associated application. Sharing the cache across components also increases the trust boundary: compromise or misbehavior in another local Skill may expose or replace the token. ...[truncated 1508 chars]- Remediation
View remediation