T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Health Records Are Stored Without Explicit Restrictive Permissions
- Content
View full analysis
> "$DATA_DIR/log.log" ``` Other command handlers and the export function use the same directory without explicitly setting restrictive file permissions. ### Technical Analysis The Skill stores potentially sensitive health and wellness information in `~/.local/share/step`, but it does not set a restrictive process `umask`, create the directory with mode `0700`, or create data files with mode `0600`. Consequently, the permissions of the directory, log files, history, and exports depend on the environment's inherited `umask`. With a commonly used `022` umask, newly created files may receive mode `0644` and the directory may receive mode `0755`. On systems where the user's home directory is traversable, other local accounts could read stored step counts, goals, reminders, activity timestamps, and arbitrary health-related notes. This issue does not provide remote code execution, privilege escalation, or write access to privileged system resources. It creates a local confidentiality exposure limited to records accessible through the resulting filesystem permissions. The script also contains a separate correctness issue: command handlers use `local` outside functions and may terminate before reaching their write operations in Bash. This can prevent the intended logging path from operating in the current version, but it does not provide a reliable security boundary and may disappear after routine maintenance. ### Attack Path 1. The Skill is run in an environment with a permissive `umask`, such as `022`. 2. The initialization code creates `~/.local/share/step` without an e ...[truncated 1173 chars]- Remediation
View remediation