T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Undocumented Plaintext Persistence of Potentially Sensitive User Input
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:5-8,scripts/script.sh:31,scripts/script.sh:34-77
Vulnerability Type: Plaintext storage and logging of potentially sensitive data
Risk Level: MediumThe undocumented
script.shutility creates persistent storage outside the project and writes user-supplied data to plaintext files. This behavior is not described inSKILL.md, which identifiesscripts/doc.shas the supported entry point.Vulnerable Code
bash DATA_DIR="${LEAVE_DOC_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/leave-doc}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }bash cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } cmd_info() { echo " Version: $VERSION | Data: $DATA_DIR" _log "info" "${1:-}" }Technical Analysis
The script creates
${XDG_DATA_HOME}/leave-docor$HOME/.local/share/leave-docas soon as it starts, even when the requested operation does not require persistent storage. It does not establish a restrictiveumaskor explicitly set permissions on the direc ...[truncated 2254 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
scripts/script.shfrom the package if it is unrelated to the documented leave-document functionality. - If persistent storage is required, document every file created, the stored fields, retention behavior, and deletion procedure.
- Do not log raw command arguments. Record only non-sensitive event metadata, or make logging explicitly opt-in.
- Require an explicit initialization or consent step before creating persistent files.
- Apply restrictive permissions before creating storage:
bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" - Create data and history files with owner-only permissions and verify that existing files are not symbolic links before writing.
- Implement
removeso that it actually removes the selected record, and provide a command that securely clears all retained application data. - Define and enforce a retention period instead of preserving entries indefinitely.
- Avoid storing sensitive leave reasons unless they are strictly necessary; prefer identifiers or redacted summaries.
- Add automated tests confirming that deletion works, sensitive arguments are not logged, and generated files have restrictive permissions.
- Remove