T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_temu_token_store.py:29- Finding
Temu access tokens are stored in plaintext without enforced restrictive permissions
- Content
View full analysis
str: return os.environ.get("TEMU_TOKEN_STORE_PATH", DEFAULT_STORE_PATH) ``` ```python def _save_store(data: dict) -> None: path = store_path() parent = os.path.dirname(path) if parent: os.makedirs(parent, exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) f.write("\n") ``` ```python entry = { "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": access_token, "updatedAt": _utc_now(), } ``` ### Technical Analysis The token store persists complete Temu access tokens as unencrypted JSON. The code creates the parent directory and output file without explicitly setting owner-only permissions. Consequently, the effective permissions depend on the process umask and preexisting directory or file permissions. On a multi-user host, shared development environment, CI worker, or machine running untrusted local processes, the file may be readable by principals that should not have access to the Temu account. The `TEMU_TOKEN_STORE_PATH` override also permits storage in locations with weaker access controls. There is no use of an operating-system credential manager, encryption at rest, atomic replacement, symlink protection, or validation that the destination is a regular owner-controlled file. ### Attack Path 1. A user saves a Temu token using `save_temu_access_token.py`. 2. `_save_store()` writes the complete token to `~/.linkfox/temu-access-tokens.json`, or to a path selected through `TEMU_TOKEN_STORE_PATH`. 3. The host's umask or existing filesystem permissions allow an ...[truncated 581 chars]- Remediation
View remediation