T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:27- Finding
API Key Stored Without Enforced Restrictive File Permissions
- Content
View full analysis
~/.config/datafast/api_key ``` ### Technical Analysis The documented setup procedure writes a long-lived DataFast API key to a plaintext file without explicitly setting restrictive directory or file permissions. The effective permissions therefore depend on the user's current `umask` and any pre-existing permissions on `~/.config/datafast`. If the file is readable by another local account or an untrusted process running under a context that can access the user's files, the Bearer token can be recovered. The instructions subsequently use this token to authenticate requests to analytics, visitor, goal, and payment endpoints. The project does not contain executable code that independently creates this file; the exposure arises when a user follows the documented configuration procedure. ### Attack Path 1. A user follows the documented setup commands and creates `~/.config/datafast/api_key`. 2. The user's environment has a permissive `umask`, or the configuration directory already has insufficiently restrictive permissions. 3. A local attacker or untrusted process enumerates readable files under the user's configuration directory. 4. The attacker reads the DataFast API key from `~/.config/datafast/api_key`. 5. The attacker submits the stolen key in an `Authorization: Bearer` header to the DataFast API. 6. Subject to the permissions associated with the key, the attacker accesses analytics and visitor information or invokes goal and payment operations. ### Impact Assessment Successful exploitation exposes the privileges granted to the compromised DataFast API key. Potential scope includes unauthorized access to website analytics and visitor information ...[truncated 227 chars]- Remediation
View remediation
~/.config/datafast/api_key chmod 600 ~/.config/datafast/api_key ``` Additional hardening measures: 1. Avoid placing the literal secret in shell history; read it silently or obtain it from an environment variable populated by a trusted secret manager. 2. Prefer an operating-system credential store or dedicated secret-management service where supported. 3. Validate file ownership and permissions before reading the key, and refuse to use files writable or readable by unintended users. 4. Document API-key rotation and immediate revocation procedures. 5. Apply the corrected setup procedure consistently in both `SKILL.md` and `README.md`. ]]>