T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Undisclosed Persistent Storage of User-Supplied Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 5–8, 34, and 40–86
Vulnerability Type: Persistent plaintext storage with insufficient access-control hardening
Risk Level: LowVulnerable Code
bash VERSION="2.0.0" DATA_DIR="${POEM_GENERATOR_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/poem-generator}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }User-controlled command arguments are passed to this logging function throughout the command handlers:
bash _log "draft" "${1:-}" _log "headline" "${1:-}" _log "outline" "${1:-}" _log "seo" "${1:-}" _log "schedule" "${1:-}" _log "hooks" "${1:-}" _log "cta" "${1:-}" _log "repurpose" "${1:-}" _log "metrics" "${1:-}" _log "ideas" "${1:-}"Technical Analysis
The script persistently appends user-supplied topics to
history.logunder the configured data directory. This collection and retention are not disclosed by the poetry-oriented skill documentation and are not necessary to produce the command output.The script creates the directory and log file without setting a restrictive
umaskor explicitly applying permissions such as0700to the directory and0600to the file. Consequently, effective access permissions depend on the invoking user's environment. With a permissive default umask and traversable parent directories, other local accounts or processes may be able to read retained topics.The log has no retention limit, deletion mechanism, redaction, or consent control. Topics supplied to content-related commands may contain confidential project names, unpublished campaign details, personal information, or other sensitive text.
Attack Path
- A user invokes a command with sensitive text, for example:
bash scripts/script.sh draft "Confidential acquisition strategy" - The correspondi ...[truncated 1176 chars]
- A user invokes a command with sensitive text, for example:
- Remediation
View remediation
Remediation Suggestions
- Remove persistent logging if it is not required for the skill's documented functionality.
- If logging is required, clearly disclose what data is collected, where it is stored, and how long it is retained.
- Require explicit user consent before recording command arguments.
- Establish restrictive permissions before creating storage:
bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" touch -- "$DATA_DIR/history.log" chmod 600 -- "$DATA_DIR/history.log" - Avoid recording raw arguments. Store only non-sensitive operational metadata, or redact and truncate user-provided values.
- Add configurable retention limits and a command that securely clears stored history.
- Validate that the configured data path is appropriate before writing and document the security implications of overriding it with
POEM_GENERATOR_DIR. - Update
SKILL.mdso the documented commands and data-handling behavior accurately match the executable script.