T09 · Insecure Skill Coding Practices
- Location
scripts/clip2md.js:35- Finding
Bearer Token Stored Without Explicit Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/clip2md.js, lines 35–38
Vulnerability Type: Plaintext credential storage with permissions dependent on the process umask
Risk Level: MediumVulnerable Code:
javascript function saveConfig(config) { fs.mkdirSync(CONFIG_DIR, { recursive: true }); fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2)); }Technical Analysis
The application stores the clip2md bearer token in plaintext at
~/.clip2md/config.json. Neither the configuration directory nor the file is created with an explicit restrictive mode. Their effective permissions therefore depend on the process umask.Under a common umask of
0022, the directory may be created as0755and the file as0644, allowing other local users to traverse the directory and read the credential. The bundled smoke test expects directory mode0700and file mode0600, but the audited implementation does not explicitly enforce either mode.The network transmission of the token to the clip2md service is required for the declared functionality, but making the locally persisted credential potentially readable by unrelated users exceeds the minimum access necessary.
Attack Path
- A victim runs
node scripts/clip2md.js config <token>in an environment with a permissive umask. - The CLI creates
~/.clip2md/config.jsonwithout explicitly assigning mode0600. - Another local user checks the victim's home directory and configuration-file permissions.
- If traversal and read permissions are available, the attacker reads
~/.clip2md/config.json. - The attacker extracts the bearer token and uses it to authenticate directly to the clip2md API.
- The attacker can consume the victim's quota and access API operations authorized by that token, including task metadata available to the account.
Impact Assessment
Exploitation requires access as another local user and permiss ...[truncated 283 chars]
- A victim runs
- Remediation
View remediation
Remediation Suggestions
- Create
~/.clip2mdwith mode0700:javascript fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 }); fs.chmodSync(CONFIG_DIR, 0o700); - Write the token file with mode
0600and explicitly correct permissions on an existing file:javascript fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600, }); fs.chmodSync(CONFIG_FILE, 0o600); - Prefer an atomic write to a securely created temporary file in the same directory, followed by a rename, to avoid partial files and permission races.
- Where supported, store the token in an operating-system credential manager rather than a plaintext JSON file.
- Update the smoke test so its permission assertions are run in continuous integration and cannot diverge from the implementation.
- Create