T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Persistent Plaintext Storage of Potentially Sensitive Command Input
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Representative command-input capture: ```bash ingest) shift if [ $# -eq 0 ]; then echo "Recent ingest entries:" tail -20 "$DATA_DIR/ingest.log" 2>/dev/null || echo " No entries yet. Use: warehouse ingest " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/ingest.log" local total=$(wc -l < "$DATA_DIR/ingest.log") echo " [Warehouse] ingest: $input" echo " Saved. Total ingest entries: $total" _log "ingest" "$input" fi ``` Equivalent raw-input logging occurs in the `transform`, `query`, `filter`, `aggregate`, `visualize`, `export`, `sample`, `schema`, `validate`, `pipeline`, and `profile` branches. ### Technical Analysis The script stores raw command arguments in command-specific log files and duplicates them in `history.log`. Inputs to warehouse-related commands may contain database queries, schema information, pipeline configuration, customer records, identifiers, tokens, passwords, or connection details. The script creates its data directory with `mkdir -p` and appends to files without setting restrictive permissions. Consequently, directory and file permissions depend on the invoking process's `umask`. Under a permissive configuration, other local users or processes may be able to read the retained data. The behavior also increases exposure by duplicating each payload ...[truncated 2410 chars]- Remediation
View remediation