T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Personal habit data may be created with permissive filesystem permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ### Technical Analysis The application stores personal habit, health, routine, and productivity records under `~/.local/share/habithero`. It creates the data directory and log files without setting a restrictive `umask` or explicitly enforcing filesystem permissions. Consequently, the effective permissions depend on the environment in which the script runs. With a common `022` umask, the directory can be created as mode `755` and log files as mode `644`, making the records readable by other local users who can traverse the user's home directory. This issue applies not only to `history.log`, but also to the command-specific logs and generated export files created elsewhere in the script. ### Attack Path 1. A user runs HabitHero in an environment with a permissive umask, such as `022`. 2. The script creates `~/.local/share/habithero` and its log files without restrictive modes. 3. The user records potentially sensitive habits, health activities, routines, reminders, or reviews. 4. Another account on the same system enumerates the user's accessible home directories. 5. The local account reads the HabitHero logs or exports and obtains the recorded personal information. The attack requires local filesystem access under another account and sufficient permission to traverse the affected user's home directory. ### Impact Assessment The vulnerability can disclose all HabitHero records and exports to unauthorized local users. Exposed information may include personal routines, health-related habits, schedules, reminders, and historical activity. The issue affects confidentiality within the current user's account data. It does not ...[truncated 118 chars]- Remediation
View remediation