T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/listonic.py:42
- Finding
- Credential Configuration File May Be Stored with Unsafe Permissions## Vulnerability Details **File Location**: `scripts/listonic.py`, lines 42–44 **Vulnerability Type**: Insecure storage permissions for authentication credentials **Risk Level**: Medium ```python def _save_config(cfg: dict[str, Any]) -> None: CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) CONFIG_PATH.write_text(json.dumps(cfg, indent=2) + "\n") ``` ### Technical Analysis The configuration file can contain a Listonic email and password, OAuth access token, refresh token, and client authentication values. The code creates the credential directory and writes the file without explicitly enforcing restrictive filesystem permissions. Consequently, permissions depend on the process umask. In addition, rewriting an existing file does not correct permissions that are already overly permissive. On a multi-user system, another local user may therefore be able to read the credentials. The credential-path access itself is necessary for the Skill's declared Listonic functionality. The weakness is not that credentials are accessed, but that least-privilege permissions are not enforced when sensitive data is persisted. ### Attack Path 1. A user creates the Listonic configuration or authenticates using token or email/password mode. 2. During authentication or token refresh, `_save_config` writes credentials and updated tokens to `~/.openclaw/credentials/listonic/config.json`. 3. A permissive umask, permissive parent-directory permissions, or pre-existing unsafe file permissions leave the file readable by another local account. 4. A local attacker reads and copies the password, access token, or refresh token. 5. The attacker authenticates to Listonic and performs operations allowed by the compromised account. This path requires local filesystem access under an account capable of traversing the relevant directories and reading the insufficiently protected file. ### Impact Assessment Successful exploitation may disclose the victim's Listonic password or ...[truncated 367 chars]
- Remediation
- ## Remediation Suggestions - Create `~/.openclaw/credentials/listonic` with mode `0700`. - Create and maintain `config.json` with mode `0600`. - Correct unsafe permissions on existing directories and files rather than relying only on creation-time modes. - Write updates atomically using a temporary file in the same directory: 1. Create the temporary file with mode `0600`. 2. Write and flush the serialized configuration. 3. Call `fsync` where durability is required. 4. Replace the destination using `os.replace`. - Validate that the destination is a regular file and avoid following attacker-controlled symbolic links where the threat model includes untrusted local users. - Prefer a platform credential store or secret manager over a plaintext JSON file when available. - Document the required file permissions in `README.md` and `SKILL.md`.