T09 · Insecure Skill Coding Practices
Warning
- Location
- skill.md:81
- Finding
- Bearer Token Stored in a Plaintext Credentials File Without Access-Control Requirements<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 81-89 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```markdown **Warning: Save your token immediately.** Its format begins with `zhihu_`, and it is required for all subsequent requests. The suggested storage location is `~/.config/hammerknows/credentials.json`: ```json { "token": "zhihu_abc123...", "agent_name": "your agent name" } ``` ``` ### Technical Analysis The Skill instructs the Agent to persist an account bearer token in a plaintext JSON file. Persisting this service-specific token is reasonably necessary for authenticated community operations and does not, by itself, exceed the Skill's declared scope. However, the instructions do not require restrictive directory or file permissions, atomic file creation, an operating-system credential manager, protection from backups, or safeguards against logging and accidental disclosure. The token functions as the Agent's identity for authenticated requests. It is repeatedly used in an `Authorization: Bearer` header and therefore must be treated as a password-equivalent secret. If the credentials file inherits permissive permissions or is exposed through backups, support bundles, filesystem indexing, or another local process, possession of the token may be sufficient to impersonate the Agent. No evidence was found that the Skill intentionally transmits this token to unrelated domains. Its documentation explicitly limits token transmission to `https://api.hammer-knows.xyz/v1/*`. The vulnerability concerns insecure local storage rather than deliberate credential exfiltration. ### Attack Path 1. The Agent registers with the service and receives a bearer token. 2. Following the Skill documentation, the Agent writes the token to `~/.config/hammerknows/credentials.json`. 3. The file or its parent directory is created without explicitly enforced restrictive permissions. 4. Another l ...[truncated 1166 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system credential manager or secret-storage facility instead of a plaintext JSON file. 2. If file-based storage is unavoidable: - Create `~/.config/hammerknows` with permissions `0700`. - Create `credentials.json` atomically with permissions `0600`. - Refuse to use the file, or warn the user, if ownership or permissions are unsafe. - Avoid temporary copies created with broader default permissions. 3. Never print the token in logs, command traces, error reports, heartbeat output, or diagnostic bundles. 4. Exclude the credentials file from source control, synchronization, and unencrypted backups. 5. Document a token revocation and rotation procedure for suspected disclosure. 6. Consider storing only the token in the secret manager while retaining non-sensitive metadata, such as the agent name, in the JSON configuration file. 7. Continue enforcing the documented destination restriction so that the bearer token is sent only over HTTPS to `https://api.hammer-knows.xyz/v1/*`. ]]>