T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/utils/log.js:24
- Finding
- Automatic Plaintext Retention of Collected Kuaishou Data## Vulnerability Details **File Location**: `scripts/utils/log.js:24-34`; invoked by `scripts/kuaishou/search-cli.js:208-211`, `scripts/kuaishou/post-cli.js:183-186`, and `scripts/kuaishou/comment-cli.js:163` **Vulnerability Type**: Automatic plaintext storage with insufficient access and retention controls **Risk Level**: Low ### Vulnerable Code ```js const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → Saved to ${outputFilename}`); } catch (error) { utils.printError(`Log write failed: ${error.message}`); } ``` A representative invocation from `scripts/kuaishou/search-cli.js` is: ```js await log.taskWrite( `${startTime}_${keyword}_${sort}_${time}_${duration}_${limit}_search.json`, JSON.stringify(finalOutput, null, 2), ); ``` Equivalent result persistence occurs in the post and comment CLI scripts. ### Technical Analysis Every successful collection operation automatically writes the complete structured API response to the project’s `logs/` directory. The implementation does not: - Ask the user to opt into persistence. - Specify restrictive directory or file permissions. - Apply a retention period or remove old results. - Minimize or redact personally attributable fields returned in comments, creator profiles, or posts. - Prevent search terms from being included in filenames. The exact effective permissions depend on the process umask and host filesystem. Consequently, the files may be accessible to other local users or processes in permissively configured environments. Although the collected information is described as public Kuaishou data, the retained datasets can still reveal research interests, targeted creators, comments, identifiers, and consolidated behavioral information. The API token is not included in the saved result ...[truncated 1457 chars]
- Remediation
- ## Remediation Suggestions 1. Make result persistence opt-in through an explicit option such as `--output` or `--save`. 2. Create the storage directory with owner-only permissions, such as mode `0700`. 3. Create result files with mode `0600`, using exclusive creation where appropriate to prevent accidental replacement. 4. Store logs in a user-designated data directory rather than inside the installed Skill package. 5. Use random or opaque filenames instead of embedding search keywords or target identifiers. 6. Add configurable retention limits and automatic expiration or deletion. 7. Minimize saved content and allow users to redact creator, commenter, URL, and identifier fields. 8. Clearly document that complete results are stored locally, including their location and retention behavior. 9. Consider disabling persistence by default in shared, CI, sandboxed, or multi-user environments.