T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Plaintext Infrastructure Inputs Stored Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:5-9; representative logging sink atscripts/script.sh:119-128, repeated for other core commands through line 300
Vulnerability Type: Plaintext storage of potentially sensitive data with permissions dependent on the caller's umask
Risk Level: MediumVulnerable Code
bash DATA_DIR="${HOME}/.local/share/infra-wrapper" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Representative command handler:
bash run) shift if [ $# -eq 0 ]; then echo "Recent run entries:" tail -20 "$DATA_DIR/run.log" 2>/dev/null || echo " No entries yet. Use: infra-wrapper run <input>" else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log")The handler subsequently invokes
_log "run" "$input", resulting in the same input being stored in both the command-specific log andhistory.log. Equivalent behavior is repeated for the other core commands.Technical Analysis
The script accepts arbitrary infrastructure-related text and persists it in plaintext. Such inputs can include cloud credentials, access tokens, backend secrets, sensitive resource identifiers, internal topology, or commands containing secrets.
The data directory is created with
mkdir -pand no explicit mode, and the script does not set a restrictive umask. Log files are created through shell redirection without an explicit0600permission. Consequently, their effective permissions depend on the invoking environment. Under a permissive or common umask, files may be readable by other local users or processes that can traverse the user's home directory.Sensitive inputs are duplicated in a command-specific log and
history.log, increasing exposure. Export functionality, if cor ...[truncated 1524 chars]- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive umask before creating any persistent data:
bash umask 077 -
Create and verify the data directory with owner-only permissions:
bash install -d -m 0700 "$DATA_DIR" chmod 0700 "$DATA_DIR" -
Create log and export files with mode
0600, and verify permissions before appending:bash touch "$DATA_DIR/history.log" chmod 0600 "$DATA_DIR/history.log" -
Avoid recording complete commands by default. Store only non-sensitive metadata, such as the operation type, timestamp, and a redacted summary.
-
Redact common secret-bearing arguments and values before logging, including passwords, tokens, authorization headers, access keys, private keys, and Terraform variable assignments marked as sensitive.
-
Add an explicit opt-in option when full command logging is required and warn users that inputs are persisted locally.
-
Apply the same restrictive permissions and redaction controls to every export file.
-
Provide a retention and secure-deletion mechanism so sensitive historical records do not remain indefinitely.
-