T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Undocumented Plaintext Persistence of User-Supplied Task Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:5-31
Vulnerability Type: Undisclosed plaintext storage and insufficient file-permission hardening
Risk Level: LowVulnerable Code
bash DATA_DIR="${MEETING_AGENDA_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/meeting-agenda}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" show_help() { cat << EOF meeting-agenda v$VERSION Productivity and task management tool Usage: meeting-agenda <command> [args] Commands: add Add item list List items done Mark done priority Set priority today Today view week Week view remind Set reminder stats Statistics clear Clear completed export Export help Show this help version Show version Data: \$DATA_DIR EOF } _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" }Technical Analysis
The script creates a persistent data directory under the user's home directory whenever it starts. The
addcommand appends the complete user-supplied task text todata.log, while_logrecords command activity and the first supplied argument inhistory.log.The project documentation describes agenda-generation commands, but this script instead implements an unrelated persistent task-management interface. Consequently, users may not reasonably expect meeting or task content to be retained on disk.
The script does not set a restrictive
umaskor explicitly assign permissions to the directory and log files. Their effective permissions therefore depend on the invoking environment. On systems with a permissive umask, other local accounts or p ...[truncated 1730 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
scripts/script.shif persistent task management is not part of the documented skill functionality, or update the documentation to describe its behavior accurately. - Avoid creating the data directory for help, version, and other operations that do not require persistence.
- Apply restrictive permissions before creating storage:
bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" - Create data and history files with owner-only permissions and verify existing files before writing:
bash touch -- "$DB" "$DATA_DIR/history.log" chmod 600 -- "$DB" "$DATA_DIR/history.log" - Do not record user-supplied content in activity logs by default. If logging is necessary, make it opt-in and record only non-sensitive operational metadata.
- Clearly disclose what information is retained, where it is stored, and how long it remains.
- Implement functional deletion and retention controls that remove both task data and corresponding history entries.
- Validate that
MEETING_AGENDA_DIRresolves to an intended user-controlled location before writing, and use--for filesystem command operands where supported.
- Remove