T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/geekbi_auth.py:69
- Finding
- Bearer Tokens Are Mirrored Across Multiple Local Storage Locations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:69-90`, `scripts/geekbi_auth.py:371-377` **Vulnerability Type**: Excessive credential persistence and cross-skill state collision **Risk Level**: Medium ### Vulnerable Code ```python def _user_config_state_path(): return _absolute_path( user_config_path("GeekBI", appauthor=False, ensure_exists=True) / "temu-research-skill" / AUTH_FILE_NAME ) def _skill_state_path(): return _absolute_path(Path(__file__).parent.parent / AUTH_STATE_DIR / AUTH_FILE_NAME) def _workspace_state_path(): return _absolute_path(Path(os.getcwd()) / AUTH_STATE_DIR / AUTH_FILE_NAME) def _resolve_stores(): candidates = ( ResolvedStore(_user_config_state_path(), "user-config-directory"), ResolvedStore(_skill_state_path(), "skill-directory"), ResolvedStore(_workspace_state_path(), "working-directory"), ) ``` ```python def _write_state_files(stores, payload): normalized = _normalize_state(payload) errors = [] written = 0 for store in stores: try: _write_state_file(store, normalized) written += 1 except OSError as error: errors.append(f"{store.kind}: {_storage_probe_reason(error)}") ``` ### Technical Analysis The authentication state includes the GeekBI bearer access token. Instead of storing that credential in one dedicated user configuration location, the implementation mirrors the same state into up to three locations: 1. A user configuration directory. 2. The installed Skill directory. 3. A `.geekbi` directory beneath the current working directory. This duplication exceeds the minimum persistence required for authenticated AliExpress API access. Skill and workspace directories are more likely to be processed by development tools, workspace synchronization, backup software, artifact packaging, or other processes running under the same user account. The user configur ...[truncated 2063 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store authentication state in one dedicated user configuration location, for example: ```python user_config_path("GeekBI", appauthor=False) / "aliexpress-research-skill" / AUTH_FILE_NAME ``` 2. Remove the Skill-directory and working-directory stores from `_resolve_stores`; bearer credentials should never be mirrored into source trees or arbitrary workspaces. 3. Correct the `temu-research-skill` namespace to an AliExpress-specific namespace to enforce separation between Skills. 4. Prefer an operating-system credential manager, such as Keychain, Credential Manager, or Secret Service, rather than a plaintext JSON token file. 5. During migration, read a legacy state file only when necessary, write its state to the corrected secure location, and securely remove all obsolete copies. 6. Ensure logout and token revocation remove every historical copy, including the incorrectly named Temu path and any prior workspace or Skill-directory files. 7. On platforms where restrictive POSIX modes are unavailable, apply platform-native access controls or fail safely rather than silently accepting weaker protection. 8. Add automated tests asserting that authentication never writes beneath the Skill installation directory or current working directory and that AliExpress and Temu authentication namespaces cannot collide. ]]>