T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:36
- Finding
- API Key Stored Without Enforced Restrictive File Permissions## Vulnerability Details **File Location**: `SKILL.md:36-44` (also documented in `README.md:26-34`) **Vulnerability Type**: Plaintext secret stored with potentially insecure permissions **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash mkdir -p ~/.config/soccer-cli touch ~/.config/soccer-cli/config.yaml ``` ```yaml apikey: YOUR_API_KEY_HERE ``` ### Technical Analysis The documented configuration procedure stores the API-Football key in a plaintext file but does not enforce owner-only permissions on either the configuration directory or file. The resulting permissions depend on the user's current `umask` and any preexisting directory permissions. For example, a common `umask` of `022` can create the file with mode `0644`, allowing other local users to read it when the home directory is traversable. The application subsequently reads this credential and transmits it in the `x-apisports-key` HTTPS request header. No hardcoded credential or transmission to an undeclared host was identified, but disclosure of the configuration file would expose the user's API credential. ### Attack Path 1. A user follows the documented commands to create `~/.config/soccer-cli/config.yaml`. 2. The file is created under a permissive `umask` or inside an inadequately protected home/configuration directory. 3. Another local account enumerates readable files under the victim's configuration directory. 4. The attacker reads the plaintext `apikey` value. 5. The attacker submits API-Football requests using the stolen key. Exploitation requires local access and filesystem permission to traverse the relevant parent directories. ### Impact Assessment An attacker may obtain the API-Football key and make requests under the victim's account. This can consume API quota, interfere with availability, and potentially cause account-level or billing consequences depending on the associated subscription. The issue does not grant operating- ...[truncated 80 chars]
- Remediation
- ## Remediation Suggestions - Replace the documented creation procedure with commands that enforce owner-only access: ```bash install -d -m 700 "$HOME/.config/soccer-cli" install -m 600 /dev/null "$HOME/.config/soccer-cli/config.yaml" ``` - Update both `SKILL.md` and `README.md` so their instructions are consistent. - At runtime, inspect the configuration file's permission bits and reject or prominently warn about files readable or writable by group or other users. - Ensure the application does not print the API key in errors, diagnostics, or debug logs. - Document key rotation as the response to suspected configuration-file disclosure.