T05 · Unauthorized Access and Privilege Escalation
Note
- Location
- lib/api.ts:18
- Finding
- Overbroad Access to a Shared Credential File<![CDATA[ ## Vulnerability Details **File Location**: `lib/api.ts:18-23`; related setup instruction at `SKILL.md:26-27` **Vulnerability Type**: Violation of least privilege through access to a shared secrets file **Risk Level**: Low ### Vulnerable Code `lib/api.ts:18-23`: ```ts const envFile = readFileSync( `${process.env.HOME}/.config/env/global.env`, "utf-8" ); const match = envFile.match(/TWITTERAPI_IO_KEY=["']?([^"'\n]+)/); if (match) return match[1]; ``` Related instruction in `SKILL.md:26-27`: ```bash cd ~/clawd/skills/x-research source ~/.config/env/global.env # needs TWITTERAPI_IO_KEY ``` ### Technical Analysis The skill only requires `TWITTERAPI_IO_KEY`, but its fallback implementation reads the entire shared `~/.config/env/global.env` file into process memory. In addition, the documented `source` command imports every variable in that file into the shell environment rather than loading only the required key. If this shared file contains unrelated credentials, such as cloud tokens, database passwords, or API keys for other services, those secrets become accessible to the CLI process and its descendants. This exceeds the minimum access needed to perform X/Twitter searches. The reviewed code does not explicitly transmit unrelated credentials, and no evidence of intentional credential exfiltration was found. Exploitation therefore requires an additional disclosure mechanism, such as compromised runtime code, diagnostic capture, process-environment inspection, or a future vulnerability. Nevertheless, unnecessarily exposing unrelated credentials increases the consequence of such a compromise. ### Attack Path 1. A user stores multiple service credentials in `~/.config/env/global.env`. 2. The user follows `SKILL.md` and runs `source ~/.config/env/global.env`, exporting all credentials into the current shell, or invokes the CLI without `TWITTERAPI_IO_KEY`, causing `lib/api.ts` to read the complete file. 3. Unrelated secrets become available in p ...[truncated 920 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to source the complete shared environment file: ```bash source ~/.config/env/global.env ``` 2. Require callers to provide only the necessary variable: ```bash export TWITTERAPI_IO_KEY="..." bun run x-search.ts search "query" ``` 3. Prefer a dedicated secrets file containing only this integration's key, for example: ```text ~/.config/x-research/credentials.env ``` Restrict it to the owning user: ```bash chmod 600 ~/.config/x-research/credentials.env ``` 4. If file-based fallback remains necessary, parse the dedicated file without exporting its contents globally and reject files with unsafe ownership or permissions. 5. Avoid storing unrelated credentials together in a single global environment file. Separate credentials by application and grant each process access only to the secrets it needs. 6. Document that the API key must not be placed inline in recorded commands and should be rotated if process logs, agent transcripts, or diagnostics may have exposed it. ]]>