T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Profiling Inputs Are Persisted in Plaintext Without Explicit Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 5–8 and repeated command handlers at lines 128–303
Vulnerability Type: Plaintext storage of potentially sensitive information with permissions inherited from the environment
Risk Level: MediumVulnerable Code
bash DATA_DIR="${HOME}/.local/share/web-profiler" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Representative input-storage block:
bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Web Profiler] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input"Equivalent plaintext writes are repeated for the
check,convert,analyze,generate,preview,batch,compare,export,config,status, andreportcommands.Technical Analysis
The script accepts arbitrary command-line input and appends it to command-specific log files under
~/.local/share/web-profiler/. It also duplicates the same input intohistory.log. The intended use cases include recording URLs, SQL statements, configuration details, dependency information, and request diagnostics, all of which may contain credentials or other sensitive data.The script does not set a restrictive
umask, explicitly create the data directory with mode0700, or enforce mode0600on generated files. Consequently, effective permissions depend on the invoking user's umask and the permissions of any pre-existing directory or files. On a system with permissive settings, other local users or processes may be able to read the stored information.The implementation also performs no secret detection or redaction before persisting input. Information such as authorization headers, API keys, session identifiers, passwords embedded in connection strings, or sensitive query parameters ma ...[truncated 1610 chars]
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive file-creation mask before creating or writing any data:
bash umask 077 -
Create and verify the data directory with owner-only permissions:
bash install -d -m 0700 "$DATA_DIR" chmod 0700 "$DATA_DIR" -
Create log files with mode
0600before appending data, and reject unsafe pre-existing file types such as symbolic links:bash log_file="$DATA_DIR/run.log" if [ -L "$log_file" ]; then echo "Refusing to write through a symbolic link" >&2 exit 1 fi : >> "$log_file" chmod 0600 "$log_file" -
Apply equivalent protection to
history.logand every command-specific log file. -
Redact common sensitive values before storage, including authorization headers, passwords, cookies, API keys, access tokens, and sensitive URL query parameters.
-
Clearly document that users must not supply credentials or secrets. Consider requiring explicit confirmation when input matches common credential patterns.
-
Add configurable retention and secure deletion policies so diagnostic information is not retained indefinitely.
-
Add automated tests that run under permissive umask settings and verify that the directory remains
0700and generated files remain0600.
-