T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/family_os_init.py:506- Finding
Private Household Workspace Created Without Restrictive Filesystem Permissions
- Content
View full analysis
bool: if path.exists(): return False path.parent.mkdir(parents=True, exist_ok=True) path.write_text(content, encoding="utf-8") return True ``` ```python def write_config(config: Path, workspace: Path, language: str, ask_sensitive: bool) -> None: config.parent.mkdir(parents=True, exist_ok=True) text = f"""workspace: {workspace} language: {language} privacy_mode: local-only auto_update: enabled: true update_dashboard: true update_memory: true update_projects: true ask_before_sensitive_write: {str(ask_sensitive).lower()} """ config.write_text(text, encoding="utf-8") ``` ```python def init_workspace(workspace: Path, archive_existing: bool, language: str) -> tuple[list[str], Path | None]: workspace.mkdir(parents=True, exist_ok=True) archive_dir = archive_existing_workspace(workspace) if archive_existing else None created: list[str] = [] for directory in DIRS: path = workspace / directory if not path.exists(): path.mkdir(parents=True) created.append(directory + "/") for rel, content in render_files(language).items(): if write_if_missing(workspace / rel, content): created.append(rel) return created, archive_dir ``` ### Technical Analysis The project is designed to store sensitive household data, including financial, medical, legal, identity, child, relationship, and address information. However, the initializer does not explicitly restrict permissions on the workspace, its subdirectories, generated Markdown files, or `~/.family-os/config.yaml`. `Path.mkdir()` normally requests mode `0777`, while `Path.write_text()` creates files using th ...[truncated 1905 chars]- Remediation
View remediation