T09 · Insecure Skill Coding Practices
- Location
scripts/onboard.sh:34- Finding
Insecure Collection and Storage of a 1Password Service-Account Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/onboard.sh:34-48,scripts/onboard.sh:88-94, andscripts/onboard.sh:112-140
Vulnerability Type: Plaintext sensitive-data handling and insecure file permissions
Risk Level: MediumVulnerable Code
bash set_kv() { # set_kv <file> <KEY> <VALUE> local file="$1" key="$2" val="$3" mkdir -p "$(dirname "$file")" touch "$file" if grep -qE "^${key}=" "$file"; then # replace first occurrence # shellcheck disable=SC2016 sed -i -E "0,/^${key}=.*/s//${key}=\"${val//\"/\\\"}\"/" "$file" else printf '%s="%s"\n' "$key" "$val" >> "$file" fi }bash write_skill_local_env() { local disp="$1" wdisp="$2" token="$3" { echo "# secure-autofill env (machine-specific)" echo "# Example file: ${CFG_EXAMPLE}" echo "" echo "DISPLAY=\"${disp}\"" echo "WAYLAND_DISPLAY=\"${wdisp}\"" if [[ -n "$token" ]]; then echo "OP_SERVICE_ACCOUNT_TOKEN=\"${token}\"" fi } > "$CFG_REAL" }bash echo echo "OP_SERVICE_ACCOUNT_TOKEN is optional if you use 1Password desktop integration." read -r -p "OP_SERVICE_ACCOUNT_TOKEN (leave blank to skip): " token echo echo "About to write skill-local env:" echo " DISPLAY=\"$disp\"" echo " WAYLAND_DISPLAY=\"$wdisp\"" if [[ -n "$token" ]]; then echo " OP_SERVICE_ACCOUNT_TOKEN=<set>" else echo " OP_SERVICE_ACCOUNT_TOKEN=<empty>" fi read -r -p "Confirm? [y/N]: " ok [[ "$ok" =~ ^[Yy]$ ]] || fail "aborted" write_skill_local_env "$disp" "$wdisp" "$token" echo "Wrote: $CFG_REAL" echo read -r -p "Update gateway env file ($GATEWAY_ENV)? [y/N]: " doenv if [[ "$doenv" =~ ^[Yy]$ ]]; then echo "Ensuring: $GATEWAY_ENV" mkdir -p "$(dirname "$GATEWAY_ENV")" touch "$GATEWAY_ENV" prompt_apply_key "DISPLAY" "$disp" 0 prompt_apply_key "WAYLAND_DISPLAY" "$wdisp" ...[truncated 2922 chars]- Remediation
View remediation
Remediation Suggestions
-
Collect the token without terminal echo:
bash read -r -s -p "OP_SERVICE_ACCOUNT_TOKEN (leave blank to skip): " token printf '\n' -
Set a restrictive umask before creating or replacing any secret-bearing file:
bash umask 077 -
Explicitly enforce owner-only permissions after writing both environment files:
bash chmod 600 "$CFG_REAL" chmod 600 "$GATEWAY_ENV" -
Write files through securely created temporary files in the same directory, apply mode
600, and atomically rename them into place. This avoids exposing partially written content and makes permission handling deterministic. -
Preserve restrictive permissions when updating an existing gateway environment file and reject files not owned by the current user.
-
Validate values before serialization. Reject newline and carriage-return characters, and use a robust environment-file encoder rather than interpolating untrusted values directly into
sedreplacement expressions. -
Prefer avoiding persistent service-account tokens where possible. Use the 1Password desktop integration or another short-lived credential mechanism, and grant service accounts access only to the minimum required vaults and items.
-
Add the documented
config.env.exampletemplate to the package so onboarding behavior can be tested, then add automated tests verifying silent token input and mode600for every file containing credentials.
-