T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:60- Finding
Bearer Token Replicated Across Unnecessary and Conflicting Storage Locations
- Content
View full analysis
Vulnerability Details
File Location:
scripts/geekbi_auth.py:60-79, 379-392, 637-648
Vulnerability Type: Excessive credential replication and cross-Skill authentication namespace collision
Risk Level: MediumVulnerable Code
python def _user_config_state_path(): return _absolute_path( user_config_path("GeekBI", appauthor=False, ensure_exists=True) / "temu-research-skill" / AUTH_FILE_NAME ) def _skill_state_path(): return _absolute_path(Path(__file__).parent.parent / AUTH_STATE_DIR / AUTH_FILE_NAME) def _workspace_state_path(): return _absolute_path(Path(os.getcwd()) / AUTH_STATE_DIR / AUTH_FILE_NAME) def _resolve_stores(): candidates = ( ResolvedStore(_user_config_state_path(), "user-config-directory"), ResolvedStore(_skill_state_path(), "skill-directory"), ResolvedStore(_workspace_state_path(), "working-directory"), )python def _write_state_files(stores, payload): normalized = _normalize_state(payload) errors = [] written = 0 for store in stores: try: _write_state_file(store, normalized) written += 1 except OSError as error: errors.append(f"{store.kind}: {_storage_probe_reason(error)}") if written == 0: reason = "；".join(errors) or "登录状态目录不可用" raise OSError(reason)python def save_token(latest): latest_server = latest["servers"].get(server_key) if not isinstance(latest_server, dict): return False, False latest_pending = latest_server.get("pending") if not isinstance(latest_pending, dict): return False, False if latest_pending.get("deviceCode") != pending.get("deviceCode"): return False, False _remove_access_token(latest_server) latest_server["accessToken"] = access_token latest_server["accessTokenExpiresA ...[truncated 3336 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the unrelated
temu-research-skilldirectory with a dedicated namespace such asgeekbi-coupang-research-skill. - Keep one authoritative authentication store in the operating system's user configuration or credential-storage facility. Do not mirror bearer tokens into the Skill installation directory or current working directory.
- Prefer an operating-system credential manager or keyring for the access token. Store only non-sensitive metadata in JSON when practical.
- Implement a migration routine that reads legacy state once, writes it to the corrected secure location, and removes obsolete copies from the Temu namespace, Skill directory, and workspace.
- Avoid silently suppressing failures when deleting legacy credential files. Report failed cleanup so users can remove residual token copies.
- Continue enforcing owner-only permissions on POSIX systems and add equivalent access-control validation for Windows.
- Bind state records to an allowlisted HTTPS origin and reject non-HTTPS authentication base URLs before loading or transmitting a token.
- Add automated tests asserting that authentication state is written only to the intended Coupang-specific location, that no workspace copy is created, and that file permissions are restrictive.
- Invalidate or rotate tokens that may already have been replicated, particularly where project or workspace directories have been shared or archived.
- Replace the unrelated