T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Undisclosed Persistent Logging of User-Supplied Command Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:5-7,scripts/script.sh:35-76
Vulnerability Type: Plaintext storage of potentially sensitive user input
Risk Level: LowVulnerable Code
bash DATA_DIR="${DECISION_MAKER_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/decision-maker}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_init() { echo " Project initialized in $(pwd)" _log "init" "${1:-}" } cmd_check() { echo " Running lint + type check + tests..." _log "check" "${1:-}" } cmd_build() { echo " Building..." _log "build" "${1:-}" } cmd_test() { echo " Running test suite..." _log "test" "${1:-}" } cmd_deploy() { echo " Deploy: build -> test -> stage -> prod" _log "deploy" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: checking project health..." _log "status" "${1:-}" } cmd_template() { echo " Template for: $1" _log "template" "${1:-}" } cmd_docs() { echo " Generating docs..." _log "docs" "${1:-}" } cmd_clean() { echo " Cleaned build artifacts" _log "clean" "${1:-}" }Technical Analysis
The script creates a persistent data directory whenever it starts and appends the first user-supplied command argument to
history.logfor multiple commands. The logged value is written in plaintext without sensitivity filtering, explicit user consent, retention controls, or restrictive permissions established by the script.The resulting permissions depend on the caller's existing
umask. In environments with permissive defaults or an attacker-controlledDECISION_MAKER_DIR, the log may be accessible to unintended local users or processes. The behavior is also not disclos ...[truncated 1508 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
scripts/script.shif the unrelated developer-workflow interface is not an intended part of the decision-analysis skill. -
Disable argument logging by default and require explicit, documented opt-in if operational history is genuinely necessary.
-
Do not persist raw command arguments. Log only a fixed command identifier or redact values that may contain confidential information.
-
Establish restrictive permissions before creating storage:
bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" -
Create the history file with owner-only permissions and verify that the resolved destination is an expected directory before writing.
-
Validate or avoid externally supplied
DECISION_MAKER_DIRvalues where the execution environment may be untrusted. -
Document what is collected, where it is stored, how long it is retained, and how users can inspect or delete it.
-
Add tests confirming that sensitive arguments are not written to persistent storage and that created files are not accessible to other users.
-