T09 · Insecure Skill Coding Practices
- Location
scripts/notes.sh:25- Finding
Plaintext Logging of Sensitive Notes Metadata
- Content
View full analysis
Vulnerability Details
File Location:
scripts/notes.sh:25-31, with sensitive logging calls atscripts/notes.sh:151,scripts/notes.sh:222, andscripts/notes.sh:391
Vulnerability Type: Plaintext storage of potentially sensitive metadata with permissions dependent on the caller's umask
Risk Level: LowVulnerable Code
bash LOGFILE="${SKILL_DIR:-$(dirname "$0")/..}/logs/notes.log" # Append-only action log log_action() { mkdir -p "$(dirname "$LOGFILE")" printf '%s\t%s\t%s\t%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2" "$3" >> "$LOGFILE" }Sensitive values are passed to the logging function at the following locations:
bash log_action "create-note" "${account:-default}/${folder:-default}" "$title"bash log_action "read-note" "${account:-default}/${folder:-default}" "$name"bash log_action "search-notes" "${account:-default}" "$query"Technical Analysis
The script stores note titles, requested note names, search queries, account names, and folder names in a persistent plaintext log. These values may reveal private subjects or sensitive search activity even though complete note bodies are not logged.
The logging function creates its directory and appends to the file without explicitly establishing restrictive permissions. Consequently, effective permissions depend on the invoking process's umask and on any pre-existing directory or log file. In an environment with permissive filesystem permissions, another local user or process could read the retained metadata.
Logging is documented in
SKILL.md, but disclosure does not mitigate the confidentiality and retention risks associated with storing sensitive metadata in plaintext.Attack Path
- A user creates or reads a note with a sensitive title, or searches for a sensitive term.
- The script passes the title, note name, query, account, or folder to
log_action. log_actionappen ...[truncated 858 chars]
- Remediation
View remediation
Remediation Suggestions
-
Do not log note titles, note names, or search queries by default. Replace them with non-sensitive operation identifiers or a fixed redacted marker.
-
If correlation is required, use a keyed pseudonymous identifier rather than an unsalted hash that could be guessed from common titles or queries.
-
Establish restrictive permissions before creating any logging resources:
bash umask 077 mkdir -p -m 700 "$(dirname "$LOGFILE")" touch "$LOGFILE" chmod 600 "$LOGFILE" -
Validate that an existing log path is a regular file owned by the current user before appending to it.
-
Make detailed logging opt-in and clearly warn users that Notes metadata may be sensitive.
-
Implement retention limits, secure rotation, and deletion so metadata is not stored indefinitely.
-
Review backup policies to prevent unnecessary propagation of the log.
-