T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Undisclosed Plaintext Persistence of User-Supplied Data
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ```bash cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } ``` ```bash cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } ``` ### Technical Analysis The skill is documented as a product-description, SEO, comparison, and localization helper. However, `scripts/script.sh` implements an unrelated persistent data utility that creates a local data directory and records caller-supplied values in plaintext. The `add` command writes all supplied arguments to `data.log`. The `_log` function also appends command names and selected arguments to `history.log`. Search terms are therefore retained as well. This storage behavior is not disclosed in `SKILL.md`, and the implementation provides no retention limits, sensitive-data warning, access-control initialization, or secure deletion mechanism. The directory and files inherit permissions from the executing process's current `umask`. The script does not enforce a restrictive mode such as owner-only access. On systems with permissive defaults, shared accounts, backups, or other local readers, retained product information may become accessible beyond its intended audience. The `PRODUCT_DESC_DIR` environment variable permits storage to be redirected ...[truncated 1946 chars]- Remediation
View remediation