T09 · Insecure Skill Coding Practices
- Location
scripts/gmail-auth.sh:56- Finding
OAuth Refresh Token Can Remain in a Temporary File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/gmail-auth.sh, lines 56-75
Vulnerability Type: Incomplete cleanup of plaintext OAuth credentials
Risk Level: MediumVulnerable Code
bash # Create token file for gog import token_file=$(mktemp) cat > "$token_file" << EOF { "email": "${email}", "client": "default", "refresh_token": "${refresh_token}", "scopes": ["${SCOPE}"] } EOF echo -e "${GREEN}Token exchange successful!${NC}" echo "" echo "Importing to gog..." if [[ -z "$GOG_KEYRING_PASSWORD" ]]; then echo -e "${YELLOW}Note: Set GOG_KEYRING_PASSWORD environment variable for non-interactive import${NC}" fi gog auth tokens import "$token_file" rm "$token_file"Technical Analysis
The script writes a Gmail OAuth refresh token in plaintext to a temporary file. Although
mktempnormally creates a uniquely named file with restrictive permissions, cleanup occurs only aftergog auth tokens importsucceeds.The script enables
set -e, so a nonzero exit fromgog, an interruption, termination signal, system failure, or shell crash can end execution beforerm "$token_file"is reached. The resulting file may remain in the temporary directory until an external cleanup process removes it.A Gmail refresh token is a long-lived credential. The configured
gmail.modifyscope permits broad mailbox access, including reading messages, sending mail, and modifying mailbox state. Consequently, residual plaintext storage is security-sensitive even if access is initially limited to the account that created the file.Attack Path
- A user successfully completes the Google OAuth authorization flow.
- The script exchanges the authorization code and receives a refresh token.
- The refresh token is written to the file created by
mktemp. gog auth tokens importfails, the process is interrupted, or the host terminates before the explicitrmcomma ...[truncated 1067 chars]
- Remediation
View remediation
Remediation Suggestions
Register cleanup immediately after creating the file so it occurs on normal exit, errors, and common termination signals:
bash token_file=$(mktemp) chmod 600 "$token_file" cleanup() { rm -f -- "$token_file" } trap cleanup EXIT HUP INT TERMAdditional hardening measures:
- Set
umask 077near the beginning of the script before creating any credential-bearing files. - If supported by
gog, import the token through standard input or a protected file descriptor rather than writing it to disk. - Validate that the temporary file is a regular file owned by the current user before writing to it.
- Keep the cleanup trap active until import completes, then remove the file explicitly and clear the trap.
- Avoid including temporary credential files in backups, crash reports, or diagnostic collections.
- Consider overwriting the file before removal where the underlying storage environment makes that meaningful, while recognizing that secure overwriting is unreliable on journaling or copy-on-write filesystems.
- Set