T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:55- Finding
Twilio authentication token stored in plaintext
- Content
View full analysis
"$CONFIG_FILE" << EOF { "account_sid": "$account_sid", "auth_token": "$auth_token", "from_number": "$from_number", "to_number": "$to_number" } EOF # Set secure permissions chmod 600 "$CONFIG_FILE" ``` ### Technical Analysis The Twilio Auth Token is entered through a normal terminal prompt, so its characters remain visible while the user types. The token is then stored persistently as plaintext in `twilio.json`. File mode `600` appropriately restricts access to the owning user, but it does not encrypt the secret or protect it from malicious processes running under that user, compromised user-level applications, exposed backups, or accidental copying of the configuration file. Because the Account SID and Auth Token are stored together, disclosure of this file provides reusable Twilio API credentials. The exact capabilities available to an attacker depend on the permissions and configuration of the affected Twilio account. ### Attack Path 1. A user runs `scripts/setup.sh` and enters the Twilio Auth Token at the visible prompt. 2. A nearby observer, terminal recording mechanism, or screen-capture process observes the token; alternatively, an attacker with access to files owned by the same user reads `twilio.json`. 3. The attacker extracts the Account SID and Auth Token. 4. The attacker authenticates directly to Twilio APIs with the stolen credentials. 5. The attacker performs operations allowed by the affected Twilio account, potentially including unauthorized calls that incur charges. ### Impact Assessment Successful exploitation exposes credentials associated with the user's Twilio account. An attacker may initiate unauthorized communicatio ...[truncated 286 chars]- Remediation
View remediation