T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Local activity data is created without explicit restrictive permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Representative entry write: ```bash run) shift if [ $# -eq 0 ]; then echo "Recent run entries:" tail -20 "$DATA_DIR/run.log" 2>/dev/null || echo " No entries yet. Use: milestone run " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Milestone] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" ``` Equivalent plaintext writes appear in the other entry-command handlers and in export generation. ### Technical Analysis The script creates `~/.local/share/milestone` with `mkdir -p` and creates logs through shell redirection without first setting a restrictive `umask` or explicitly applying secure modes. The resulting permissions therefore depend on the environment from which the script is launched. Milestone inputs are arbitrary user-provided text and may include private report, configuration, analysis, or project information. The same input is written both to a command-specific log and to `history.log`. If the process has a permissive `umask`, these files may be readable by unintended local accounts. The files are plaintext and are not encrypted. This does not grant remote access or elevated privileges. Exploitation requires an attacker who already has local access and sufficient permission to traverse the user's home directory and read the resulting files. ### Attack P ...[truncated 785 chars]- Remediation
View remediation