T09 · Insecure Skill Coding Practices
- Location
scripts/worktracker.py:31- Finding
Work Records and Backups Are Created with Overly Permissive Default Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/worktracker.py:31-32,scripts/worktracker.py:60-61,scripts/worktracker.py:84-85,scripts/worktracker.py:93-94,SKILL.md:231-233, anddocs/WorkTracker培训手册.md:226-228
Vulnerability Type: Insecure local file permissions
Risk Level: MediumVulnerable Code
Directory creation does not specify restrictive permissions:
python def ensure_directories(self): """Ensure directories exist""" os.makedirs(CONFIG_DIR, exist_ok=True) os.makedirs(BACKUP_DIR, exist_ok=True)Configuration, status, and log files are opened without enforcing restrictive file modes:
python def save_config(self): """Save configuration""" with open(self.config_path, 'w', encoding='utf-8') as f: json.dump(self.config, f, ensure_ascii=False, indent=2)python def save_status(self, status): """Save work status""" status["last_updated"] = datetime.now().isoformat() with open(WORK_STATUS_PATH, 'w', encoding='utf-8') as f: json.dump(status, f, ensure_ascii=False, indent=2)python def log_work(self, assistant: str, action: str, details: str): """Record a work log""" timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") log_entry = f"## {timestamp} - {assistant} - {action}\n\n{details}\n\n" with open(WORK_LOG_PATH, 'a', encoding='utf-8') as f: f.write(log_entry)The documentation explicitly recommends world-readable permissions:
bash chmod 755 ~/.openclaw/workspace/.worktracker/ chmod 644 ~/.openclaw/workspace/.worktracker/*.json chmod 644 ~/.openclaw/workspace/.worktracker/*.mdTechnical Analysis
WorkTracker stores assistant names, work descriptions, deadlines, progress updates, completion results, follow-up actions, roles, and optional email addresses in local JSON and Markdown files. These records can contain confidential operatio ...[truncated 2197 chars]
- Remediation
View remediation
Remediation Suggestions
-
Create private data directories with mode
0700:python os.makedirs(CONFIG_DIR, mode=0o700, exist_ok=True) os.makedirs(BACKUP_DIR, mode=0o700, exist_ok=True) os.chmod(CONFIG_DIR, 0o700) os.chmod(BACKUP_DIR, 0o700) -
Create configuration, status, log, backup, and default export files with mode
0600. Useos.openwith explicit flags and permissions for newly created files:python fd = os.open( path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600, ) with os.fdopen(fd, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) -
Apply
os.chmod(path, 0o600)to existing files during initialization or migration, because the creation mode does not repair an already existing permissive file. -
Perform status and configuration updates atomically using a securely created temporary file in the protected directory, set it to
0600, flush and synchronize it, and then replace the destination withos.replace. -
Validate that sensitive destinations are regular files and reject symbolic-link targets where applicable to reduce link-based file manipulation risks.
-
Ensure backup files and user-default exports receive mode
0600; do not assume copied metadata is secure. -
Replace the documented permission commands with:
bash chmod 700 ~/.openclaw/workspace/.worktracker/ chmod 700 ~/.openclaw/workspace/.worktracker/backups/ chmod 600 ~/.openclaw/workspace/.worktracker/*.json chmod 600 ~/.openclaw/workspace/.worktracker/*.md chmod 600 ~/.openclaw/workspace/.worktracker/backups/* -
Either implement the documented read, write, and administrative authorization model or remove those claims so users do not incorrectly rely on nonexistent access controls.
-