T09 · Insecure Skill Coding Practices
- Location
lib/tokens.js:17- Finding
OAuth Tokens Stored Without Explicit Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
lib/tokens.js, lines 17-20
Vulnerability Type: Plaintext sensitive-token storage with insufficiently enforced filesystem permissions
Risk Level: Mediumjs function writeTokens(tokens) { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(TOKENS_PATH, JSON.stringify(tokens, null, 2) + '\n'); }Technical Analysis
The
writeTokensfunction serializes OAuth token data, potentially including access and refresh tokens, directly into~/.cache/whoop-morning/tokens.json. Neither the cache directory nor the token file is created with an explicit restrictive permission mode.Node.js therefore derives the permissions from its defaults and the process umask. The directory is ordinarily based on mode
0777and the file on mode0666, each modified by the active umask. In an environment with an unexpectedly permissive umask, other local users may be able to traverse the directory or read the token file. If the paths already exist, this implementation also does not verify or correct their ownership, permissions, or file type.The file is stored in plaintext. Although plaintext storage may be operationally necessary when an OS credential store is unavailable, explicit access controls are required to restrict token access to the owning account.
The documentation also instructs users to store the WHOOP client secret and refresh token in
~/.clawdbot/.env. Sending OAuth credentials and authorization codes to WHOOP's documented OAuth endpoint is necessary for the declared integration, and no transmission to an unrelated destination was identified. However, the referenced authorization and reporting executables were absent from the supplied project, so their network and credential-handling behavior could not be independently verified.Attack Path
- The skill runs under a process whose umask allows group or global access to newly created files or directori ...[truncated 1235 chars]
- Remediation
View remediation
Remediation Suggestions
- Create the cache directory with mode
0700and verify that it is owned by the current user. - Create the token file with mode
0600, and explicitly correct permissions on an existing file withchmod. - Reject symbolic links and non-regular files before reading or writing the token cache to reduce link-based attacks.
- Write tokens atomically to a securely created temporary file in the same protected directory, set mode
0600, flush it, and rename it over the destination. - Where available, store refresh tokens in an operating-system credential manager or secret store rather than a plaintext JSON file.
- Avoid logging or returning complete token objects, and retain only fields required for authentication and expiration checks.
- Document the token-cache location, required permissions, OAuth scopes, revocation procedure, and cleanup process.
- Apply equivalent permission hardening to
~/.clawdbot/.env, which the setup documentation uses for the client secret and refresh token.
- Create the cache directory with mode