T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:35
- Finding
- Undocumented Persistent Logging of Raw Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 5–7 and 35–76 **Vulnerability Type**: Plaintext persistence of potentially sensitive command arguments **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${INTERN_REPORT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/intern-report}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_query() { echo " Query: $*" _log "query" "${1:-}" } cmd_import() { echo " Importing: $1" _log "import" "${1:-}" } cmd_export() { echo " Exporting to: ${1:-stdout}" _log "export" "${1:-}" } cmd_transform() { echo " Transforming: $1 -> $2" _log "transform" "${1:-}" } cmd_validate() { echo " Validating schema..." _log "validate" "${1:-}" } cmd_stats() { echo " Records: $(wc -l < "$DB" 2>/dev/null || echo 0)" _log "stats" "${1:-}" } cmd_schema() { echo " Fields: id, name, value, timestamp" _log "schema" "${1:-}" } cmd_sample() { [ -f "$DB" ] && head -5 "$DB" || echo "No data" _log "sample" "${1:-}" } cmd_clean() { echo " Cleaning data..." _log "clean" "${1:-}" } cmd_dashboard() { echo " Total: $(wc -l < "$DB" 2>/dev/null || echo 0) records" _log "dashboard" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory under the invoking user's home directory, or at a caller-controlled location supplied through `INTERN_REPORT_DIR`. Its `_log` function appends command names and raw first arguments to `history.log`. Arguments to commands such as `query`, `import`, `export`, and `transform` may contain sensitive query content, filenames, directory structures, project identifiers, or other user-provided information. These values are stored without redaction, explicit consent, retention limits, or restrictive permission initialization. The resulting permissions depend on the invoking process's `uma ...[truncated 1790 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `scripts/script.sh` if it is unrelated to the declared internship-report functionality. 2. If the utility is intentional, document its purpose, storage location, logged fields, and retention behavior in `SKILL.md`. 3. Disable history logging by default and require an explicit opt-in option. 4. Do not store raw command arguments. Record only non-sensitive operational metadata, such as the command name and a success or failure status. 5. If argument logging is essential, redact credentials, tokens, personal information, query contents, and sensitive path components before writing. 6. Create files with restrictive permissions: ```bash umask 077 mkdir -p -- "$DATA_DIR" touch -- "$DATA_DIR/history.log" chmod 600 -- "$DATA_DIR/history.log" ``` 7. Validate `INTERN_REPORT_DIR` before use and reject unsafe or unexpectedly shared destinations. 8. Add log rotation, maximum retention limits, and an explicit command for securely deleting stored history. 9. Clearly notify users before persistent data is created and provide a no-logging mode. ]]>