T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_temu_token_store.py:31- Finding
Temu access tokens are stored and disclosed in plaintext
- Content
View full analysis
None: path = store_path() parent = os.path.dirname(path) if parent: os.makedirs(parent, exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) f.write("\n") ``` `scripts/_temu_token_store.py:62-68`: ```python entry = { "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": access_token, "updatedAt": _utc_now(), } ``` `scripts/get_temu_access_token.py:51-60`: ```python print( json.dumps( { "found": True, "storeKey": store_key, "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": token, }, indent=2, ensure_ascii=False, ) ) ``` ### Technical Analysis The Skill stores Temu access tokens as unencrypted JSON in `~/.linkfox/temu-access-tokens.json`, or at a path supplied through `TEMU_TOKEN_STORE_PATH`. The file is created with the process's default umask rather than an explicitly restrictive mode such as `0600`. The implementation does not: - Use an operating-system credential manager or encrypted secret store. - Explicitly restrict file permissions. - Validate file ownership. - Reject symbolic links before writing. - Perform an atomic, permission-preserving replacement. - Prevent the complete token from being printed to stdout. The retrieval command prints the full access token rather than returning a masked value. ...[truncated 2567 chars]- Remediation
View remediation