T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Unprotected and Undisclosed Writes to Predictable Local Files
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 5–7, 35, and 63
Vulnerability Type: Predictable file writes, symbolic-link following, and plaintext retention of user-controlled data
Risk Level: MediumVulnerable Code
bash DATA_DIR="${LOAN_CALCULATOR_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/loan-calculator}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }bash echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*"Technical Analysis
The script creates a persistent data directory on every invocation and appends data to the predictable paths
history.loganddata.log. It neither establishes restrictive permissions nor verifies that the destination files are regular files owned by the expected user.Shell append redirection follows symbolic links. If either predictable destination is replaced with a symbolic link, the script appends its output to the linked target using the privileges of the process executing the script. The primitive is limited to appending attacker-influenced text; it does not provide arbitrary replacement of existing file content.
The
addcommand stores the complete argument list in plaintext. The_logfunction also records command information. These persistent storage behaviors are not disclosed inSKILL.mdand are unrelated to the documented loan-calculation functionality. Consequently, users may provide financial or other sensitive values without realizing that another bundled script can retain supplied content locally.The effective accessibility of the files depends on the process umask because neither the directory nor the files receive explicit restrictive modes. A permissive execution environment could therefore expose retained information to other local users.
Attack Path
A symbolic-link exploitation path requires local ...[truncated 2035 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
scripts/script.shif it is an unused generic template, because it does not implement the loan-calculator commands documented by the project. - Clearly document all persistent storage, including the exact files created, the retained fields, the retention period, and deletion instructions.
- Create the storage directory and files with restrictive permissions:
bash umask 077 install -d -m 700 -- "$DATA_DIR" touch -- "$DB" "$DATA_DIR/history.log" chmod 600 -- "$DB" "$DATA_DIR/history.log" - Reject symbolic links and unexpected file types before writing. Where possible, open files safely using a small implementation that supports no-follow semantics such as
O_NOFOLLOW, verifies ownership withfstat, and writes through the already-validated file descriptor. - Canonicalize and constrain
LOAN_CALCULATOR_DIR. Do not honor an externally supplied storage directory in privileged or automated execution contexts unless it has been explicitly validated. - Verify that the directory and destination files are owned by the effective user and are not group- or world-writable.
- Do not log user arguments by default. If logging is necessary, record only non-sensitive command metadata and provide an explicit opt-in mechanism.
- Validate and minimize data accepted by
add, and provide a functional deletion command and retention policy for stored records. - Never run this script with elevated privileges. If privileged execution is unavoidable, use a fixed root-owned directory and secure file-descriptor-based writes.
- Remove