T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Notion API Key Stored in a Potentially World-Readable Plaintext File
- Content
View full analysis
~/.config/notion/api_key ``` ### Technical Analysis The documented setup procedure writes the Notion API key to a plaintext file without explicitly restricting either the directory or file permissions. Their resulting permissions depend on the user's current `umask` and any pre-existing filesystem permissions. For example, a common `umask` of `022` can cause the directory and file to be created with permissions equivalent to `0755` and `0644`, respectively. On a multi-user system, this may allow other local accounts or processes to read the credential. The instructions also do not address secure replacement, deletion, or rotation of the stored token. Exploitation requires local filesystem access under an account permitted to traverse the user's home directory and read the resulting file. This is not evidence that the project intentionally transmits or misuses credentials. ### Attack Path 1. A user follows the documented configuration instructions. 2. The shell creates `~/.config/notion` and `~/.config/notion/api_key` using permissions derived from the current `umask`. 3. Under permissive permissions, another local user or compromised process reads the API key: ```bash cat /home/victim/.config/notion/api_key ``` 4. The attacker uses the recovered token to authenticate to the Notion API. 5. The attacker accesses or modifies resources that the associated Notion integration is authorized to use. ### Impact Assessment Successful exploitation exposes the privileges assigned to the compromised Notion integration. Depending on its configured capabilities and shared resources, an attacker may be able to read, create, update, or delete Notion pages and databases available to that integration. The compromise does not i ...[truncated 244 chars]- Remediation
View remediation
~/.config/notion/api_key chmod 600 ~/.config/notion/api_key ``` Additional hardening measures: - Prefer an operating-system credential manager or dedicated secrets-management service over a plaintext file. - If environment-variable configuration is supported, warn users not to place the token in shell history, committed environment files, logs, or command-line arguments. - Validate the permissions of an existing configuration directory and key file before use, and reject files readable by group or other users. - Grant the Notion integration only the capabilities and page access required for its intended operation. - Document token revocation and rotation procedures for suspected exposure. ]]>