T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:6- Finding
Productivity Data Stored Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 6-7; representative data writes at lines 128-135, repeated across other data commands
Vulnerability Type: Plaintext sensitive data stored with permissions inherited from the caller'sumask
Risk Level: Mediumbash DATA_DIR="${HOME}/.local/share/deepfocus" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Representative entry storage:
bash else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/add.log" local total=$(wc -l < "$DATA_DIR/add.log") echo " [Deepfocus] add: $input" echo " Saved. Total add entries: $total" _log "add" "$input" fiTechnical Analysis
The application stores tasks, plans, notes, reminders, reviews, history records, and exports as plaintext under
~/.local/share/deepfocus. It creates the directory withmkdir -pand creates files through ordinary shell redirection without first establishing a restrictiveumaskor explicitly setting permissions.Consequently, the resulting permissions depend on the invoking process's environment. With a common
022umask, the directory can be created as0755and log or export files as0644. On a multi-user system, these permissions can allow other local accounts to traverse the data directory and read productivity records.The same behavior affects
history.log, command-specific.logfiles, and generated JSON, CSV, or text exports. No encryption or other confidentiality control compensates for permissive filesystem permissions.Attack Path
- A victim runs a data command such as
deepfocus add,deepfocus remind, ordeepfocus review. - The script creates
~/.local/share/deepfocusand its files using permissions derived from the victim's currentumask. - Under a permissive umask such as
022, the stored files may ...[truncated 633 chars]
- A victim runs a data command such as
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive process umask before creating the data directory or any files:
bash umask 077 -
Create and enforce owner-only directory permissions:
bash mkdir -p -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" -
Restrict existing and newly generated logs and exports to the owner:
bash find "$DATA_DIR" -type f -exec chmod 600 {} + -
Create export files atomically with owner-only permissions rather than relying solely on inherited defaults.
-
Document that entries are stored locally in plaintext and advise users not to record secrets unless appropriate host-level protections, such as full-disk encryption, are enabled.
-