T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Sensitive financial records are created without enforced restrictive permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` The same unrestricted file-creation pattern is used for financial records throughout the command handlers, for example: ```bash echo "$ts|$input" >> "$DATA_DIR/record.log" ``` ### Technical Analysis The application stores potentially sensitive personal financial information under `~/.local/share/pension`, but it does not set a restrictive `umask` or explicitly assign access modes to the directory and files. Consequently, permissions are inherited from the execution environment. With a common `umask` of `022`, a newly created directory may have mode `0755`, while newly created logs and exports may have mode `0644`. On a multi-user system, these modes can permit other local users to traverse the data directory and read financial records. The `_log` function also duplicates command input in `history.log`, increasing the number of files containing sensitive information. The same permission concern applies to the command-specific logs and generated export files. ### Attack Path 1. A victim runs the Skill on a multi-user system with a permissive default `umask`, such as `022`. 2. The script creates `~/.local/share/pension` and its files without explicitly restricting their permissions. 3. The victim records balances, tax notes, budget information, forecasts, or other financial data. 4. The data is written to command-specific logs and may also be duplicated in `history.log`. 5. Another local account enumerates the victim's accessible home-directory paths and reads the files if parent-directory and file permissions permit it. 6. The local attacker obtains the stored financial information without needing the victim's application credentials. This pat ...[truncated 729 chars]- Remediation
View remediation