T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:6
- Finding
- Plaintext Activity Logs Are Created Without Explicit Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:6-9`; representative log write at `scripts/script.sh:125-133`, with equivalent behavior in all activity-recording command branches **Vulnerability Type**: Sensitive data exposure through insecure file permissions and plaintext logging **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${HOME}/.local/share/dockerlabs" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` Representative command branch: ```bash check) shift if [ $# -eq 0 ]; then echo "Recent check entries:" tail -20 "$DATA_DIR/check.log" 2>/dev/null || echo " No entries yet. Use: dockerlabs check <input>" else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" local total=$(wc -l < "$DATA_DIR/check.log") echo " [Dockerlabs] check: $input" echo " Saved. Total check entries: $total" _log "check" "$input" fi ``` ### Technical Analysis The script persistently records arbitrary user-supplied text in per-command log files and duplicates the text in `history.log`. These files are stored as plaintext under `~/.local/share/dockerlabs`. Neither the data directory nor the log files receive explicit restrictive permissions. Their resulting modes are controlled by the environment's existing directories and process `umask`. In an environment with a permissive `umask` or inadequately protected parent directory, another local account or process may be able to read the logs. The skill is intended for Docker troubleshooting and configuration workflows. Inputs in that context may contain registry credentials, access tokens, private image locations, environment variables, internal hostnames, deployment details, or copied configuration fragments. The script does not warn against submitting secrets and performs no redaction. The same issue affects ...[truncated 1249 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Set a restrictive file-creation mask before creating any persistent data: ```bash umask 077 ``` 2. Create and verify the directory with owner-only permissions: ```bash install -d -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" ``` 3. Create log files explicitly with mode `600` before appending to them: ```bash install -m 600 /dev/null "$DATA_DIR/history.log" ``` Use equivalent guarded creation for each command-specific log and avoid truncating existing files. 4. Validate that the data directory is owned by the current user and is not a symbolic link before writing to it. 5. Warn users that supplied input is retained persistently and must not include passwords, tokens, private keys, or other secrets. 6. Add configurable secret redaction for common credential formats and provide retention and secure-deletion controls. 7. Avoid duplicating full sensitive values in both the command-specific log and `history.log`; record only minimal metadata in the unified history. ]]>