T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Plaintext Activity Logs Are Created Without Explicit Restrictive Permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Representative command branch: ```bash check) shift if [ $# -eq 0 ]; then echo "Recent check entries:" tail -20 "$DATA_DIR/check.log" 2>/dev/null || echo " No entries yet. Use: dockerlabs check " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" local total=$(wc -l < "$DATA_DIR/check.log") echo " [Dockerlabs] check: $input" echo " Saved. Total check entries: $total" _log "check" "$input" fi ``` ### Technical Analysis The script persistently records arbitrary user-supplied text in per-command log files and duplicates the text in `history.log`. These files are stored as plaintext under `~/.local/share/dockerlabs`. Neither the data directory nor the log files receive explicit restrictive permissions. Their resulting modes are controlled by the environment's existing directories and process `umask`. In an environment with a permissive `umask` or inadequately protected parent directory, another local account or process may be able to read the logs. The skill is intended for Docker troubleshooting and configuration workflows. Inputs in that context may contain registry credentials, access tokens, private image locations, environment variables, internal hostnames, deployment details, or copied configuration fragments. The script does not warn against submitting secrets and performs no redaction. The same issue affects ...[truncated 1249 chars]- Remediation
View remediation