T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/script.sh:5
- Finding
- Undisclosed Persistent Logging of User-Supplied Command Arguments## Vulnerability Details **File Location**: `scripts/script.sh:5-7`, `scripts/script.sh:35-76` **Vulnerability Type**: Plaintext storage of potentially sensitive user input **Risk Level**: Low ### Vulnerable Code ```bash DATA_DIR="${DECISION_MAKER_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/decision-maker}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_init() { echo " Project initialized in $(pwd)" _log "init" "${1:-}" } cmd_check() { echo " Running lint + type check + tests..." _log "check" "${1:-}" } cmd_build() { echo " Building..." _log "build" "${1:-}" } cmd_test() { echo " Running test suite..." _log "test" "${1:-}" } cmd_deploy() { echo " Deploy: build -> test -> stage -> prod" _log "deploy" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: checking project health..." _log "status" "${1:-}" } cmd_template() { echo " Template for: $1" _log "template" "${1:-}" } cmd_docs() { echo " Generating docs..." _log "docs" "${1:-}" } cmd_clean() { echo " Cleaned build artifacts" _log "clean" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory whenever it starts and appends the first user-supplied command argument to `history.log` for multiple commands. The logged value is written in plaintext without sensitivity filtering, explicit user consent, retention controls, or restrictive permissions established by the script. The resulting permissions depend on the caller's existing `umask`. In environments with permissive defaults or an attacker-controlled `DECISION_MAKER_DIR`, the log may be accessible to unintended local users or processes. The behavior is also not disclos ...[truncated 1508 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `scripts/script.sh` if the unrelated developer-workflow interface is not an intended part of the decision-analysis skill. 2. Disable argument logging by default and require explicit, documented opt-in if operational history is genuinely necessary. 3. Do not persist raw command arguments. Log only a fixed command identifier or redact values that may contain confidential information. 4. Establish restrictive permissions before creating storage: ```bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" ``` 5. Create the history file with owner-only permissions and verify that the resolved destination is an expected directory before writing. 6. Validate or avoid externally supplied `DECISION_MAKER_DIR` values where the execution environment may be untrusted. 7. Document what is collected, where it is stored, how long it is retained, and how users can inspect or delete it. 8. Add tests confirming that sensitive arguments are not written to persistent storage and that created files are not accessible to other users.