T09 · Insecure Skill Coding Practices
- Location
scripts/kuaishou/comment-cli.js:142- Finding
Automatic Plaintext Persistence of Collected Comment and Profile Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/kuaishou/comment-cli.js:142-165; supporting file operation inscripts/utils/log.js:26-34
Vulnerability Type: Automatic plaintext storage of potentially identifying public-user data
Risk Level: MediumVulnerable Code
js const finalOutput = { status: "success", error_code: "OK", message: "Comment retrieval completed", timestamp: new Date().toLocaleString(), request: { command: "comment", url: url, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: commentTask, }; url = validator.url2Name(url); await log.taskWrite( `${startTime}_${url}_comment.json`, JSON.stringify(finalOutput, null, 2), );The shared logging function persists the supplied content without restrictive permissions:
js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content);Technical Analysis
Every successful comment request is automatically serialized and written into the project-level
logs/directory. The saved object includes the requested video identifier and the complete API response. Depending on the response schema, this can include comment text, usernames, profile identifiers, interaction data, and other public account metadata.Although the source data is described as public, creating an additional durable local copy increases its exposure and retention scope. Persistence is not required to return the requested JSON to the caller. The implementation provides no opt-out option, retention policy, automatic deletion, data minimization, or field-redaction mechanism.
fs.promises.writeFileis also called without an explicit file mode. Consequently, actual permissions depend on the process umask and oper ...[truncated 1435 chars]- Remediation
View remediation
Remediation Suggestions
-
Make result persistence opt-in through an explicit option such as
--save. -
Return results through standard output by default without creating a second durable copy.
-
Create saved files with owner-only permissions:
js await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); -
Create the
logs/directory with mode0o700. -
Add configurable retention and automatic deletion for old result files.
-
Provide a redacted storage mode that removes commenter identifiers and other unnecessary fields.
-
Warn users before storing bulk comment or profile data.
-
Add
logs/to.gitignoreand document that generated data must not be committed or shared unintentionally. -
Apply equivalent protections to search and creator-post results, which use the same persistence utility.
-