T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/config_channel.py:268
- Finding
- Message channel credentials are stored with overly broad file permissions## Vulnerability Details **File Location**: `scripts/config_channel.py`, lines 268–290 **Vulnerability Type**: Plaintext credential exposure through insecure permissions **Risk Level**: High Equivalent vulnerable logic appears in the Feishu configuration path at lines 384–405 and the DingTalk configuration path at lines 499–521. ### Vulnerable Code ```python # Update Xiaoyi configuration xiaoyi_config['ak'] = '{ak}' xiaoyi_config['sk'] = '{sk}' xiaoyi_config['agent_id'] = '{agent_id}' xiaoyi_config['enabled'] = True # Write updated configuration with open(config_file, 'w', encoding='utf-8') as f: yaml.dump( config, f, default_flow_style=False, allow_unicode=True, sort_keys=False ) print("[OK] Xiaoyi configuration updated - only specific fields modified") PYEOF chmod 644 "$CONFIG_FILE" echo "[OK] Configuration file permissions set" ``` The equivalent Feishu and DingTalk generators store `app_secret` and `client_secret` in the same file and then apply mode `0644`. ### Technical Analysis The generated remote script writes messaging-platform credentials in plaintext to: ```text /root/.jiuwenswarm/config/config.yaml ``` It then explicitly changes that file to mode `0644`. This grants read permission to users outside the owner and group. Although the file is normally located beneath `/root`, relying only on parent-directory traversal restrictions is fragile: alternate permissions, privileged helper processes, container mounts, backups, support tooling, or accidental relocation can expose the file. The file itself does not enforce least privilege. The behavior is inconsistent with the initial deployment template, which applies mode `0600` to the same configuration file. Subsequent channel configuration therefore weakens the protection of existing and newly written secrets. Timestamped backups may also retain insecure permissions after the source file has previously been changed to `0644`. ### Attack Path ...[truncated 964 chars]
- Remediation
- ## Remediation Suggestions 1. Preserve root-only permissions: ```bash install -d -m 700 /root/.jiuwenswarm/config chmod 600 "$CONFIG_FILE" chown root:root "$CONFIG_FILE" ``` 2. Set a restrictive umask before creating configuration files or backups: ```bash umask 077 ``` 3. Create backups with explicit restrictive permissions and verify existing backups: ```bash cp --preserve=mode,ownership "$CONFIG_FILE" "$BACKUP_FILE" chmod 600 "$BACKUP_FILE" chown root:root "$BACKUP_FILE" ``` 4. Prefer a dedicated secret manager or root-only environment file instead of placing secrets in a general YAML configuration file. 5. Add an automated post-write check that rejects files readable by group or others. 6. Rotate any credentials that may already have been written under mode `0644`.