T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/snapshot_git_state.sh:21
- Finding
- Plaintext Capture of Potentially Credential-Bearing Git Remote URLs## Vulnerability Details **File Location**: `scripts/snapshot_git_state.sh`, lines 21–22 and 55 **Vulnerability Type**: Plaintext sensitive-data exposure and insufficient file-permission hardening **Risk Level**: Medium ```bash OUT_DIR="$TOPLEVEL/.git-state-snapshots/$STAMP" mkdir -p "$OUT_DIR" ``` ```bash run_capture remote_verbose git -C "$TARGET" remote -v ``` ### Technical Analysis The snapshot script executes `git remote -v` and writes its complete output to `remote_verbose.txt` through `run_capture`. Git remote URLs can contain embedded usernames, passwords, personal access tokens, or other authentication data, particularly in HTTPS URLs using user-information syntax. Neither the snapshot directory nor its files are assigned restrictive permissions. Their effective permissions depend on the invoking user's `umask`; under a common `022` configuration, the directory and captured files may be readable by other local users. The snapshots are also created inside the repository worktree under `.git-state-snapshots/`, creating an additional risk that they may be staged, committed, archived, uploaded as build artifacts, or collected by backup systems. ### Attack Path 1. A user configures a Git remote whose URL contains an embedded password or access token. 2. The user follows the documented workflow and runs `scripts/snapshot_git_state.sh`. 3. The script invokes `git remote -v` and stores the complete remote URL in `.git-state-snapshots/<timestamp>/remote_verbose.txt`. 4. Because the script does not enforce private permissions or redact credentials, another local account or an artifact-collection process can read the snapshot. 5. Alternatively, the snapshot directory may be accidentally staged or archived with the repository. 6. The exposed credential can then be used against the services and repositories authorized for that credential, subject to its configured privileges. ### Impact Assessment An attacker can obtain credentials embedded in Git re ...[truncated 576 chars]
- Remediation
- ## Remediation Suggestions 1. Set a restrictive process mask before creating any diagnostic output: ```bash umask 077 ``` 2. Explicitly create the snapshot directory with owner-only permissions: ```bash mkdir -m 700 -p "$OUT_DIR" ``` 3. Do not persist complete remote URLs. Record only remote names and sanitized hosts, or redact URL user-information and sensitive query parameters before writing output. 4. If full URLs are operationally necessary, replace passwords and tokens with a fixed marker such as `[REDACTED]`. 5. Store snapshots outside the repository worktree by default. If worktree-local storage remains supported, add `.git-state-snapshots/` to an appropriate exclusion mechanism and warn users not to commit or upload it. 6. Ensure every generated file is owner-readable and owner-writable only, for example with `chmod 600 "$out"` after creation. 7. Document that snapshots created by older versions may contain secrets and should be reviewed, securely deleted, or sanitized. Credentials found in existing snapshots should be rotated.