T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_temu_token_store.py:10- Finding
Temu Access Tokens Stored in Plaintext Without Restrictive File Permissions
- Content
View full analysis
str: return os.environ.get("TEMU_TOKEN_STORE_PATH", DEFAULT_STORE_PATH) ``` ```python def _save_store(data: dict) -> None: path = store_path() parent = os.path.dirname(path) if parent: os.makedirs(parent, exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) f.write("\n") ``` ```python entry = { "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": access_token, "updatedAt": _utc_now(), } ``` ### Technical Analysis The Skill stores Temu access tokens directly in an unencrypted JSON file. Neither the parent directory nor the token file is created with an explicit restrictive mode such as `0700` for the directory and `0600` for the file. Actual permissions therefore depend on the process umask and the properties of any pre-existing path. The `TEMU_TOKEN_STORE_PATH` environment variable can also redirect the credential file to another location, including a shared directory. The implementation does not reject symbolic links, verify ownership, inspect existing permissions, or use atomic replacement. These tokens are security-sensitive bearer credentials. Their effective privilege is particularly significant because the authorization instructions elsewhere in the Skill recommend granting broad application permissions. ### Attack Path 1. A user follows the documented workflow and runs `save_temu_access_token.py`. 2. `_save_store()` creates or overwrites the configured JSON file using ambient filesystem permissions. 3. A local user, process, shared-workspace participant ...[truncated 984 chars]- Remediation
View remediation