T09 · Insecure Skill Coding Practices
Error
- Location
- skill.md:232
- Finding
- Wallet Private Key Stored in an Unencrypted Plaintext File## Vulnerability Details **File Location**: `skill.md`, lines 232–235 **Vulnerability Type**: Plaintext storage of sensitive authentication material **Risk Level**: High ```python private_key_file = os.path.join(secure_dir, "wallet_private_key.hex") with open(private_key_file, "w", encoding="utf-8") as f: f.write(private_key) os.chmod(private_key_file, 0o600) ``` ### Technical Analysis The minimum viable onboarding example persists the newly generated EVM wallet private key directly in an unencrypted file. Setting the file mode to `0600` prevents access by other ordinary local users, but it does not provide cryptographic protection. The key remains exposed to: - Malicious or compromised processes running under the same user account - Malware, information stealers, and unauthorized remote sessions - Privileged local users and administrators - Accidental inclusion in backups, disk images, or support bundles - Offline disk inspection or recovery of discarded storage media This implementation also conflicts with the encrypted-storage recommendations in `wallet_guide.md`, which recommend an encrypted wallet file, KMS, or equivalent secure storage. ### Attack Path 1. A user follows the onboarding instructions in `skill.md`. 2. The example generates a new EVM wallet and obtains its private key. 3. The private key is written in plaintext to `~/.campfire/secure/wallet_private_key.hex`. 4. A malicious process running as the same user, a privileged local attacker, or an attacker with access to a backup or disk image reads the file. 5. The attacker imports the recovered key into another wallet or signing utility. 6. The attacker can generate valid signatures as the victim wallet and control any blockchain assets subsequently assigned to that key. No network exfiltration of the private key was identified in the audited files. Exploitation requires access to the local plaintext file or a copy of it. ### Impac ...[truncated 587 chars]
- Remediation
- ## Remediation Suggestions 1. Replace plaintext key storage with an encrypted EVM keystore using a modern, memory-hard key derivation function and authenticated encryption. 2. Prefer an operating-system credential vault, hardware wallet, dedicated signing service, or KMS so raw private-key material does not persist on disk. 3. Obtain the keystore password from an interactive prompt or protected secret manager. Do not store it beside the encrypted key or embed it in the Skill. 4. Keep restrictive directory and file permissions as defense in depth, but do not treat `chmod 600` as encryption. 5. Avoid transitional plaintext files. If temporary plaintext material is unavoidable, use a private temporary location, minimize its lifetime, and ensure cleanup on both success and failure. 6. Update the onboarding example to use the same encrypted path recommended elsewhere, such as `~/.campfire/secure/wallet.enc`. 7. Warn existing users to migrate any key created by this example to secure storage and rotate to a new wallet if the plaintext file may have been exposed or backed up.