T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:35- Finding
Plaintext Persistence of Potentially Sensitive Command Arguments
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_encrypt() { echo " Encrypting: $1" _log "encrypt" "${1:-}" } cmd_hash() { echo "$1" | sha256sum | cut -d" " -f1 _log "hash" "${1:-}" } ``` ### Technical Analysis The `_log` function appends the complete second argument to a persistent `history.log` file. Both `cmd_encrypt` and `cmd_hash` pass their original user-supplied values to this function without redaction. Users may reasonably supply passwords, API tokens, recovery codes, or other confidential values to commands advertised as encryption and hashing utilities. Although `cmd_hash` prints a SHA-256 digest, it separately records the unhashed input. The `encrypt` command does not perform encryption and likewise records the plaintext value. The script does not establish a restrictive `umask` or explicitly create the log with mode `0600`. Consequently, its effective permissions depend on the invoking environment. The behavior is also unrelated to the meme-coin scanning functionality declared in `SKILL.md`, so it exceeds the data retention necessary for the Skill's stated purpose. ### Attack Path 1. A user invokes `scripts/script.sh encrypt ` or `scripts/script.sh hash `. 2. The command forwards the raw value to `_log`. 3. `_log` appends the raw value to the persistent data file at `$DATA_DIR/history.log`. 4. A local user, process, backup reader, or later attacker with access to that file retrieves the plaintext secret. 5. The exposed value may then be reused against the service or account for which it was intended. This path requires local read access to the resulting history file or to a copy of it; the reviewed code does not transmit the log over the network. ### Impact ...[truncated 455 chars]- Remediation
View remediation