T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:5
- Finding
- Financial transaction descriptions are persisted in plaintext with inherited filesystem permissions## Vulnerability Details **File Location**: `scripts/script.sh`, lines 5-7 and 25-30 **Vulnerability Type**: Plaintext storage of potentially sensitive financial data **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${FUND_ADVISOR_CN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/fund-advisor-cn}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_track() { echo " Transaction: $1 Amount: ${2:-0}" _log "track" "${1:-}" } ``` ### Technical Analysis The `track` command writes the user-supplied transaction description to `history.log` in plaintext. The script creates the data directory and log file without explicitly applying restrictive permissions. Their effective permissions therefore depend on the invoking user's `umask` and the permissions of a caller-controlled `FUND_ADVISOR_CN_DIR`. Under common permissive defaults, the directory may be created with mode `0755` and the log with mode `0644`. This can expose transaction descriptions to other local accounts or processes that can read the selected directory. The persistence of this information is also not disclosed in `SKILL.md`, which presents the project primarily as an investment-advice and calculation tool. The amount supplied to `cmd_track` is displayed but is not written by `_log`; the confirmed exposure is the transaction description and associated timestamp. ### Attack Path 1. A user invokes the documented executable with a sensitive description, for example: ```bash fund-advisor-cn track "Medical debt payment" 5000 ``` 2. `cmd_track` passes the description to `_log`. 3. `_log` appends the timestamp, operation name, and description to: ```text ~/.local/share/fund-advisor-cn/history.log ``` or to the path selected through `FUND_ADVISOR_CN_DIR`. 4. If inherited directory and file permissions allow access, another ...[truncated 953 chars]
- Remediation
- ## Remediation Suggestions 1. Establish a restrictive process umask before creating any storage: ```bash umask 077 ``` 2. Create the application directory with owner-only permissions and verify existing directories: ```bash mkdir -p -m 700 -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" ``` 3. Create and maintain log files with mode `0600`: ```bash touch -- "$DATA_DIR/history.log" chmod 600 -- "$DATA_DIR/history.log" ``` 4. Do not persist transaction descriptions by default. Require explicit opt-in or log only a non-sensitive event such as `transaction recorded`. 5. Clearly document what data is retained, where it is stored, how long it is retained, and how users can inspect or delete it. 6. Provide commands to clear history and configure retention limits. Consider automatic redaction or bounded log rotation. 7. Validate a caller-provided `FUND_ADVISOR_CN_DIR` before use. Reject unsafe destinations such as shared or world-writable directories, and check for symbolic-link or ownership issues before writing. 8. If retaining sensitive transaction details is a required feature, consider encryption at rest using operating-system credential storage or a user-managed encryption key.