T09 · Insecure Skill Coding Practices
- Location
skill.md:232- Finding
Wallet Private Key Stored in an Unencrypted Plaintext File
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 232–235
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: Highpython private_key_file = os.path.join(secure_dir, "wallet_private_key.hex") with open(private_key_file, "w", encoding="utf-8") as f: f.write(private_key) os.chmod(private_key_file, 0o600)Technical Analysis
The minimum viable onboarding example persists the newly generated EVM wallet private key directly in an unencrypted file. Setting the file mode to
0600prevents access by other ordinary local users, but it does not provide cryptographic protection.The key remains exposed to:
- Malicious or compromised processes running under the same user account
- Malware, information stealers, and unauthorized remote sessions
- Privileged local users and administrators
- Accidental inclusion in backups, disk images, or support bundles
- Offline disk inspection or recovery of discarded storage media
This implementation also conflicts with the encrypted-storage recommendations in
wallet_guide.md, which recommend an encrypted wallet file, KMS, or equivalent secure storage.Attack Path
- A user follows the onboarding instructions in
skill.md. - The example generates a new EVM wallet and obtains its private key.
- The private key is written in plaintext to
~/.campfire/secure/wallet_private_key.hex. - A malicious process running as the same user, a privileged local attacker, or an attacker with access to a backup or disk image reads the file.
- The attacker imports the recovered key into another wallet or signing utility.
- The attacker can generate valid signatures as the victim wallet and control any blockchain assets subsequently assigned to that key.
No network exfiltration of the private key was identified in the audited files. Exploitation requires access to the local plaintext file or a copy of it.
Impac
...[truncated 587 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace plaintext key storage with an encrypted EVM keystore using a modern, memory-hard key derivation function and authenticated encryption.
- Prefer an operating-system credential vault, hardware wallet, dedicated signing service, or KMS so raw private-key material does not persist on disk.
- Obtain the keystore password from an interactive prompt or protected secret manager. Do not store it beside the encrypted key or embed it in the Skill.
- Keep restrictive directory and file permissions as defense in depth, but do not treat
chmod 600as encryption. - Avoid transitional plaintext files. If temporary plaintext material is unavoidable, use a private temporary location, minimize its lifetime, and ensure cleanup on both success and failure.
- Update the onboarding example to use the same encrypted path recommended elsewhere, such as
~/.campfire/secure/wallet.enc. - Warn existing users to migrate any key created by this example to secure storage and rotate to a new wallet if the plaintext file may have been exposed or backed up.