T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.py:88- Finding
Sensitive CRM and Email Data Stored Without Restrictive Filesystem Permissions
- Content
View full analysis
str: data_dir = os.environ.get("DC_DATA_DIR", DEFAULT_DATA_DIR) os.makedirs(data_dir, exist_ok=True) return data_dir ``` ```python def write_json_file(filepath: str, data: Any) -> None: """Write data to a JSON file.""" os.makedirs(os.path.dirname(filepath), exist_ok=True) with open(filepath, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2, default=str) ``` ### Technical Analysis The common storage functions create the application data directory and JSON files without explicitly applying restrictive permissions. The resulting access modes depend entirely on the process umask. Under a common umask such as `0022`, directories can be created as `0755` and files as `0644`. These files can contain commercially and personally sensitive information, including: - Customer names, email addresses, and telephone numbers - Deal values, stages, notes, and sales history - Email subjects, sender addresses, and message snippets - Meeting notes and action items - Follow-up schedules - CRM relationship graph data - Learned sales patterns The implementation also writes directly to the destination path. It does not reject symbolic links or use a securely created temporary file followed by an atomic replacement. In an environment where another local user can modify the selected data directory, this may permit symlink-based redirection or unintended overwriting of another file writable by the Skill process. This issue is especially relevant when `DC_DATA_DIR` points to a shared, group-writable, or otherwise untrusted location. ### Attack Path 1. The Skill runs on a multi-user host or inside an environment where its data directory is reada ...[truncated 1167 chars]- Remediation
View remediation