T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:5- Finding
Undisclosed Persistent Plaintext Logging of User-Supplied Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 5–8, 26, and 28–78
Vulnerability Type: Plaintext storage of potentially sensitive user input
Risk Level: MediumVulnerable Code
bash DATA_DIR="${COPYWRITER_PRO_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/copywriter-pro}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_draft() { echo " Draft: $1 Target: ${2:-800} words" _log "draft" "${1:-}" } cmd_headline() { echo " 1. How to $1 2. $1: Complete Guide 3. Why $1 Matters" _log "headline" "${1:-}" } cmd_outline() { echo " 1. Intro | 2. Problem | 3. Solution | 4. Examples | 5. CTA" _log "outline" "${1:-}" } cmd_seo() { echo " Keywords: $1 | Title tag | Meta desc | H1-H3 | Internal links" _log "seo" "${1:-}" } cmd_schedule() { echo " Mon: Research | Tue: Write | Wed: Edit | Thu: Publish | Fri: Promote" _log "schedule" "${1:-}" } cmd_hooks() { echo " Question | Statistic | Story | Bold claim | Controversy" _log "hooks" "${1:-}" } cmd_cta() { echo " Subscribe | Share | Comment | Try it | Learn more" _log "cta" "${1:-}" } cmd_repurpose() { echo " Blog -> Thread -> Video -> Carousel -> Newsletter" _log "repurpose" "${1:-}" } cmd_metrics() { echo " Views | Clicks | Shares | Time on page | Conversions" _log "metrics" "${1:-}" } cmd_ideas() { echo " How-to | Listicle | Case study | Interview | Comparison" _log "ideas" "${1:-}" }Technical Analysis
The script creates a persistent data directory and appends the first user-supplied argument from each operational command to
history.log. The content is stored in plaintext, and the script does not explicitly establish restrictive permissions for the directory or log fi ...[truncated 1767 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove persistent argument logging unless it is essential to the documented functionality.
-
If logging is required, make it explicitly opt-in and clearly document the data location, captured fields, retention period, and deletion procedure.
-
Do not store raw user content. Record only non-sensitive operational metadata, such as the command name, or redact and truncate arguments before storage.
-
Establish restrictive permissions before creating storage:
bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" touch -- "$DATA_DIR/history.log" chmod 600 -- "$DATA_DIR/history.log" -
Validate a user-supplied
COPYWRITER_PRO_DIRand reject unsafe locations, including shared or unexpectedly writable directories. -
Provide a command to inspect and securely delete retained history, and implement a short automatic retention limit.
-
Update
SKILL.mdso that every executable entry point and all persistent data behavior are accurately disclosed.
-