T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config.sh:7- Finding
API credentials are stored in plaintext with permissions determined by the ambient umask
- Content
View full analysis
"$CONFIG_FILE" echo "✅ 凭证已保存" } get_credentials() { if [ -f "$CONFIG_FILE" ]; then cat "$CONFIG_FILE" else echo "{}" fi } ``` The secret is also accepted as a command-line argument and can be printed in full: ```bash case "$1" in save) save_credentials "$2" "$3" ;; get) get_credentials ;; ``` ### Technical Analysis The script writes the Textin application ID and secret code directly to `$HOME/.openclaw/textin-config.json`. It does not set a restrictive umask, apply `chmod 600` to the file, or verify the permissions of an existing file. Consequently, actual permissions depend on the invoking process's umask. Under a common umask of `022`, a newly created file may be mode `0644`, allowing other local users to read the API secret where home-directory traversal permissions permit it. An existing file with overly broad permissions remains overly broad after redirection. The `get` operation outputs the complete configuration, including the secret, to standard output. This can expose it through terminal recording, agent transcripts, redirected logs, CI logs, or other output consumers. The `save` interface also requires the secret as a positional command-line argument. Command-line arguments may be captured in shell history, process telemetry, audit logs, or process listings while the command runs. Constructing JSON with shell string interpolation is additionally fragile. Quotes, backslashes, or control characters in supplied values can corrupt the configurat ...[truncated 1416 chars]- Remediation
View remediation