T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:130- Finding
Plaintext API Keys Stored in a Predictable Shared Temporary File
- Content
View full analysis
/tmp/bizyair.txt # Function for recording tasks record_task() { local request_id="$1" local api_key="$2" local task_index="$3" echo "${task_index}|${request_id}|${api_key}" >> /tmp/bizyair.txt } ``` The function is subsequently called with the active API key: ```bash if [ -n "$REQUEST_ID" ] && [ "$REQUEST_ID" != "null" ]; then record_task "$REQUEST_ID" "$API_KEY" "$((i+1))" echo "✅ Task $((i+1)) created: requestId = $REQUEST_ID" fi ``` ### Technical Analysis The workflow writes active BizyAir API keys in plaintext to the fixed path `/tmp/bizyair.txt`. The file is created using ordinary shell redirection without: - A restrictive `umask` - Explicit permissions such as mode `0600` - Atomic, exclusive file creation - Symlink checks - A unique per-process filename A shared temporary directory is commonly writable by all local users. Although directory-level protections may prevent deletion of files owned by other users, they do not inherently make the contents of newly created files confidential. Under a permissive process umask, another local user may be able to read the stored bearer tokens. The predictable path also introduces a time-of-check/time-of-use and symbolic-link risk. If an attacker can pre-create `/tmp/bizyair.txt` as a symbolic link before a privileged execution, the initial truncation and subsequent writes may affect the link target. Automatic deletion after task completion does not eliminate exposure during execution and does not address symlink-based modification. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/bizyair.txt`. 2. The attacker either monitors the fixed file or pre-creates it as a symbolic link to another writable or security-sen ...[truncated 1109 chars]- Remediation
View remediation