T09 · Insecure Skill Coding Practices
Error
- Location
scripts/doubao_session.js:42- Finding
Broad Browser Cookie Collection and Plaintext Session Storage
- Content
View full analysis
c.domain.includes('doubao.com') || c.domain.includes('bytedance') || c.domain.includes('douyin.com') ); if (!dbCookies.length) { throw new Error('No Doubao cookies found. Please open doubao.com in the logged-in browser first.'); } const session = { cookies: dbCookies.map(c => ({ name: c.name, value: c.value })), savedAt: new Date().toISOString(), }; writeSession(session); return session; } ``` ### Technical Analysis The login routine calls `Network.getCookies()` without restricting collection to an exact Doubao URL. It then retains cookies whose domains contain `doubao.com`, `bytedance`, or `douyin.com`. This can collect authentication credentials for a broader collection of services than the Doubao API operation requires. The selected cookie names and values are written to `~/.doubao_chat_session.json` as unencrypted JSON. The call to `fs.writeFileSync` does not explicitly set restrictive file permissions, and the implementation does not use an operating-system credential store. Cookie attributes such as `HttpOnly`, `Secure`, domain scope, path, and expiration are also discarded, making the resulting credential collection a reusable raw cookie string. Although cookie collection is disclosed as part of the Skill's functionality, the s ...[truncated 1355 chars]- Remediation
View remediation