T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/setup.py:173
- Finding
- API tokens are persisted in plaintext and unsafely interpolated into shell startup files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py:173-213` **Additional Location**: `docs/README.md:61-69` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python value = input(f" Digite {var['name']}: ").strip() if value: # Adicionar ao shell profile shell_commands.append(f'export {var["name"]}="{value}"') os.environ[var['name']] = value # Para esta sessão print(f" ✅ {var['name']} configurado") ``` ```python def save_to_shell_profile(self, commands): """Salvar comandos no profile do shell""" try: # Detectar shell shell = os.environ.get('SHELL', '/bin/bash') if 'zsh' in shell: profile_file = Path.home() / '.zshrc' else: profile_file = Path.home() / '.bash_profile' print(f"\n 📝 Adicionando ao {profile_file}") with open(profile_file, 'a') as f: f.write('\n# AHC-Automator Environment Variables\n') for cmd in commands: f.write(f'{cmd}\n') ``` The documentation recommends the same plaintext storage pattern: ```bash echo 'export CLICKUP_API_TOKEN="seu_token_clickup"' >> ~/.zshrc echo 'export PIPEDRIVE_API_TOKEN="seu_token_pipedrive"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The setup process permanently stores ClickUp and Pipedrive API tokens in `.zshrc` or `.bash_profile`. These files are ordinary plaintext files and may be exposed through backups, support archives, shell configuration synchronization, local malware, accidental repository commits, or access by another process running as the same user. The entered value is also inserted directly into shell syntax without escaping. A value containing a double quote, newline, command substitution, or additional shell commands can break out of the intended `export` statement. The injected content executes whenever the user starts a shell or explicitly sources the profile. Fo ...[truncated 1586 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not write secrets into shell startup files by default. 2. Store tokens in an operating-system secret store such as macOS Keychain, or use a dedicated secrets manager. 3. If environment files must be supported: - Use a dedicated file rather than `.zshrc` or `.bash_profile`. - Create it with mode `0600`. - Never print its contents. - Clearly obtain explicit consent before permanent storage. 4. Avoid generating shell source code from user input. If unavoidable, serialize values using a robust shell-quoting function such as `shlex.quote()`. 5. Use `getpass.getpass()` instead of `input()` so tokens are not displayed on screen. 6. Check and enforce restrictive permissions before writing. 7. Update the README to recommend Keychain or another secure secret mechanism. 8. Rotate tokens previously stored in shell profiles and remove old plaintext entries. ]]>