T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:6
- Finding
- Potentially Sensitive Command Input Stored in Plaintext Logs## Vulnerability Details **File Location**: `scripts/script.sh`, lines 6-9 and 124-136 **Vulnerability Type**: Plaintext storage of potentially sensitive user input with inherited filesystem permissions **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${HOME}/.local/share/generator" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` ```bash run) shift if [ $# -eq 0 ]; then echo "Recent run entries:" tail -20 "$DATA_DIR/run.log" 2>/dev/null || echo " No entries yet. Use: generator run <input>" else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Generator] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" fi ;; ``` The same plaintext logging pattern is repeated for the argument-bearing command branches through line 301. ### Technical Analysis The script accepts arbitrary command arguments and is designed to append them without redaction or encryption to command-specific log files and `history.log`. The storage directory is created using `mkdir -p`, but the script does not establish a restrictive umask or explicitly set directory and file permissions. Consequently, the resulting access permissions depend on the invoking environment. Under a commonly used `022` umask, the directory may be created with mode `755` and log files with mode `644`, potentially allowing other local users or processes to read their contents. Inputs are also duplicated: once in the command-specific log and once in `history.log`. This behavior is not clearly disclosed in `SKILL.md`, which states that results are written to standard output. Users may therefore supply fixture records, tokens, personal information, or other sensitive sample dat ...[truncated 1680 chars]
- Remediation
- ## Remediation Suggestions 1. Set a restrictive umask before creating any storage: ```bash umask 077 ``` 2. Explicitly enforce secure permissions: ```bash install -d -m 700 "$DATA_DIR" touch "$DATA_DIR/history.log" chmod 600 "$DATA_DIR/history.log" ``` 3. Default to stdout-only behavior and make persistent logging an explicit opt-in feature. 4. Do not record complete user arguments. Log only non-sensitive metadata such as the command name, timestamp, success state, and a generated record identifier. 5. If input logging is necessary, implement redaction for credentials, authorization headers, tokens, passwords, private keys, and other likely secrets. 6. Avoid duplicating sensitive values across command-specific logs and `history.log`. 7. Document the persistence behavior, storage location, retention policy, and deletion procedure in `SKILL.md`. 8. Add a command that securely deletes retained records and establish an automatic retention limit or expiration period. 9. Correct the top-level use of `local`, but apply the storage protections before making the affected command branches operational.