T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:35- Finding
Undisclosed Persistent Logging of Raw User Input
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:5-7,scripts/script.sh:35-40, and equivalent logging calls through line 82
Vulnerability Type: Plaintext storage of potentially sensitive user input
Risk Level: LowVulnerable Code
bash DATA_DIR="${JD_WRITER_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/jd-writer}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_draft() { echo " Draft: $1 Target: ${2:-800} words" _log "draft" "${1:-}" }The same
_logfunction is invoked by thedraft,headline,outline,seo,schedule,hooks,cta,repurpose,metrics, andideascommands.Technical Analysis
The script persistently writes the first user-supplied command argument into
history.log. The project documentation does not disclose this data retention, and the logging is unrelated to the documented job-description workflow.The data directory and history file are created without explicit restrictive permissions. Their effective permissions therefore depend on the process umask and the permissions of parent directories. Under a common umask such as
0022, the directory and newly created file may be accessible to other local principals when the parent path is traversable.Input is recorded verbatim without redaction, minimization, expiry, or user consent. Users may pass confidential recruiting plans, business topics, company names, or other sensitive text. The
JD_WRITER_DIRenvironment variable can also redirect the log to an unexpected location, although exploitation of that behavior requires control over the execution environment.This issue does not provide command execution, privilege escalation, or network exfiltration. Its security effect is persistent local disclosure and retention of user data.
Attack Path
- A user invokes an affected command ...[truncated 1244 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove input logging if it is not essential to the documented functionality.
- If logging is required, make it explicitly opt-in and clearly disclose what is stored, where it is stored, and for how long.
- Avoid retaining raw arguments. Store only non-sensitive aggregate events such as the command name, or redact user content before writing it.
- Create the storage directory and log with restrictive permissions:
bash umask 077 install -d -m 700 -- "$DATA_DIR" touch "$DATA_DIR/history.log" chmod 600 "$DATA_DIR/history.log" - Validate that
JD_WRITER_DIRresolves to an approved user-owned location before writing to it. - Add retention controls, log rotation, and a documented command for deleting stored history.
- Use
printfrather thanechofor predictable logging behavior:bash printf '%s %s: %s\n' "$(date '+%m-%d %H:%M')" "$1" "$2" >> "$DATA_DIR/history.log" - Add tests confirming that sensitive command arguments are not written to persistent storage by default.