T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:27- Finding
Deno API bearer token stored without restrictive file permissions
- Content
View full analysis
~/.config/deno-deploy/access_token echo "your_org_id_here" > ~/.config/deno-deploy/org_id ``` `scripts/deploy.py:21-35`: ```python def get_credentials(): token_path = os.path.join(CONFIG_DIR, "access_token") org_id_path = os.path.join(CONFIG_DIR, "org_id") if not os.path.exists(token_path) or not os.path.exists(org_id_path): print("ERROR: Deno Deploy credentials not found.") print() print("1. Create a Deno Subhosting org at: https://dash.deno.com/subhosting/new_auto") print("2. Copy the org ID and access token from the org dashboard") print("3. Save them:") print(f" mkdir -p {CONFIG_DIR}") print(f' echo "your_token_here" > {token_path}') print(f' echo "your_org_id_here" > {org_id_path}') sys.exit(1) token = open(token_path).read().strip() org_id = open(org_id_path).read().strip() return token, org_id ``` ### Technical Analysis The documented credential setup writes a Deno API bearer token to a plaintext file without explicitly restricting the permissions of either the configuration directory or its files. The script repeats the same unsafe setup instructions when credentials are absent. With a typical permissive `022` umask, the directory may be created as mode `0755` and files as mode `0644`. If the user's home directory is traversable by other local accounts, the bearer token can consequently be read by an unprivileged local user. The actual exposure depends on the host's umask and parent-directory permissions, but the setup does not establish a secure baseline. The script also reads the credential paths without verifying that they: ...[truncated 2063 chars]- Remediation
View remediation
~/.config/deno-deploy/access_token printf '%s\n' "your_org_id_here" > ~/.config/deno-deploy/org_id chmod 600 ~/.config/deno-deploy/access_token chmod 600 ~/.config/deno-deploy/org_id ``` 2. Update both the documentation and runtime error instructions so they never recommend plain `mkdir` and `echo` without a restrictive umask. 3. Before reading credentials, use `os.lstat()` and reject: - Symbolic links. - Non-regular files. - Files not owned by the effective user. - Files with group or other permission bits. - A configuration directory not owned by the user or accessible by group/others. 4. Open credential files defensively, avoiding symlink traversal where the platform supports `O_NOFOLLOW`. 5. Prefer an operating-system credential store or secret manager when available. 6. Use a Deno token restricted to the minimum organization and deployment permissions required by this Skill. Document token rotation and immediate revocation procedures for suspected exposure. ]]>