T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Potentially Sensitive Operational Data Stored with Inadequate Permission Hardening
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` A representative command stores raw input and duplicates it in the history log: ```bash ingest) shift if [ $# -eq 0 ]; then echo "Recent ingest entries:" tail -20 "$DATA_DIR/ingest.log" 2>/dev/null || echo " No entries yet. Use: terminal-dashboard ingest " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/ingest.log" local total=$(wc -l < "$DATA_DIR/ingest.log") echo " [Terminal Dashboard] ingest: $input" echo " Saved. Total ingest entries: $total" _log "ingest" "$input" fi ;; ``` The same raw-input storage pattern is repeated for the other logging commands. ### Technical Analysis The script is intended to record pipeline descriptions, SQL queries, schema information, export operations, and similar operational content. Such content can include confidential dataset names, infrastructure details, query text, API information, or accidentally supplied credentials. The script creates its storage directory with `mkdir -p` and creates log files through shell redirection, but it does not establish a restrictive `umask` or explicitly set directory and file permissions. Consequently, access permissions are inherited from the runtime environment. Under a common `022` umask, newly created directories are typically mode `0755` and files mode `0644`, potentially making logs readable by other local users when the parent home directory is traversable. Input is also duplicated: it is written to a ...[truncated 1599 chars]- Remediation
View remediation