T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/setup.sh:55
- Finding
- Twilio authentication token stored in plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 34 and 55–65 **Vulnerability Type**: Plaintext storage and visible entry of sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```bash read -p "Auth Token: " auth_token ``` ```bash # Save configuration cat > "$CONFIG_FILE" << EOF { "account_sid": "$account_sid", "auth_token": "$auth_token", "from_number": "$from_number", "to_number": "$to_number" } EOF # Set secure permissions chmod 600 "$CONFIG_FILE" ``` ### Technical Analysis The Twilio Auth Token is entered through a normal terminal prompt, so its characters remain visible while the user types. The token is then stored persistently as plaintext in `twilio.json`. File mode `600` appropriately restricts access to the owning user, but it does not encrypt the secret or protect it from malicious processes running under that user, compromised user-level applications, exposed backups, or accidental copying of the configuration file. Because the Account SID and Auth Token are stored together, disclosure of this file provides reusable Twilio API credentials. The exact capabilities available to an attacker depend on the permissions and configuration of the affected Twilio account. ### Attack Path 1. A user runs `scripts/setup.sh` and enters the Twilio Auth Token at the visible prompt. 2. A nearby observer, terminal recording mechanism, or screen-capture process observes the token; alternatively, an attacker with access to files owned by the same user reads `twilio.json`. 3. The attacker extracts the Account SID and Auth Token. 4. The attacker authenticates directly to Twilio APIs with the stolen credentials. 5. The attacker performs operations allowed by the affected Twilio account, potentially including unauthorized calls that incur charges. ### Impact Assessment Successful exploitation exposes credentials associated with the user's Twilio account. An attacker may initiate unauthorized communicatio ...[truncated 286 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Read the Auth Token without terminal echo: ```bash read -s -p "Auth Token: " auth_token echo ``` - Prefer an operating-system credential store or dedicated secret manager rather than a plaintext JSON file. - If file-based storage is unavoidable, create the directory and file with restrictive permissions from the outset, such as by setting `umask 077` before creation. - Keep credentials out of backups, logs, diagnostics, and source-control repositories. - Consider using restricted API keys where Twilio supports them instead of a broadly privileged primary Auth Token. - Document credential revocation and rotation procedures for suspected exposure. ]]>