T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/utils/log.js:24
- Finding
- Automatic Plaintext Persistence of Collected Kuaishou Data## Vulnerability Details **File Location**: `scripts/utils/log.js:24-34` **Vulnerability Type**: Automatic plaintext storage of potentially sensitive collected data **Risk Level**: Medium ### Vulnerable Code ```js const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); ``` Successful commands pass their complete output to this function automatically: ```js await log.taskWrite( `${startTime}_${keyword}_${sort}_${time}_${duration}_${limit}_search.json`, JSON.stringify(finalOutput, null, 2), ); ``` Equivalent automatic writes occur in: - `scripts/kuaishou/search-cli.js:208-211` - `scripts/kuaishou/post-cli.js:181-186` - `scripts/kuaishou/comment-cli.js:161-166` ### Technical Analysis Every successful search, creator-post query, or comment query is automatically written to the project’s `logs/` directory. The persisted JSON can contain search interests, requested profile or video identifiers, public creator details, commenter identities, comment text, interaction metadata, and other complete API response fields. The implementation does not require explicit user consent before persistence, does not provide a retention or deletion mechanism, and does not request restrictive permissions when creating the directory or file. Consequently, effective access is governed by the process umask and surrounding filesystem permissions. Search terms and target identifiers may also appear in filenames, exposing research activity through directory listings even without opening the files. Local persistence is not required to fulfill the declared core behavior of returning structured JSON through standard output. The automatic write therefore exceeds the minimum filesystem privileges needed for the operation. ### Atta ...[truncated 1400 chars]
- Remediation
- ## Remediation Suggestions 1. Default to returning results through standard output without writing them to disk. 2. Make persistence explicitly opt-in through an option such as `--output` or `--save`. 3. Create the log directory with mode `0700` and result files with mode `0600`, while accounting for platform compatibility. 4. Use non-sensitive random identifiers in filenames rather than keywords, profile identifiers, or video identifiers. 5. Document exactly which data is stored, where it is stored, and how long it is retained. 6. Add configurable retention and secure cleanup controls. 7. Avoid retaining complete API responses when only a limited subset is needed. 8. Warn users before saving data that can identify creators, commenters, targets, or research interests. Example hardened write behavior: ```js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` This hardening should supplement, not replace, making local persistence opt-in.