T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_temu_token_store.py:27- Finding
Temu access tokens are stored and exposed in plaintext
- Content
View full analysis
None: path = store_path() parent = os.path.dirname(path) if parent: os.makedirs(parent, exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) f.write("\n") ``` ```python entry = { "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": access_token, "updatedAt": _utc_now(), } ``` The token retrieval command returns the complete secret: ```python print( json.dumps( { "found": True, "storeKey": store_key, "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": token, }, indent=2, ensure_ascii=False, ) ) ``` The token-listing command also permits callers to disable masking: ```python mask = True if len(sys.argv) >= 2: try: params = json.loads(sys.argv[1]) mask = params.get("mask", True) except json.JSONDecodeError as e: print(f"Invalid parameter format: {e}", file=sys.stderr) sys.exit(1) print(json.dumps(list_stores(mask=mask), indent=2, ensure_ascii=False)) ``` ### Technical Analysis Temu seller access tokens are written directly to a JSON file without encryption and without explicitly enforcing owner-only permissions on the parent directory or file. File accessibility consequently depends on the process umask and any pre-existing filesystem permissions. The retrieval utility always prints the raw access token to standard output. The listing utility masks ...[truncated 1617 chars]- Remediation
View remediation