T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/lib/session.py:50
- Finding
- Authentication Cookies Stored in Plaintext Without Restrictive File Permissions## Vulnerability Details **File Location**: `scripts/lib/session.py:50-54` **Vulnerability Type**: Plaintext storage of reusable authentication credentials **Risk Level**: Medium ### Vulnerable Code ```python def save_cookies(self): logging.info(f"Saving cookies to {self.cookies_path}...") cookies = self.context.cookies() with open(self.cookies_path, 'w', encoding='utf-8') as f: json.dump(cookies, f, indent=4) ``` ### Technical Analysis The Skill exports all cookies from the active Playwright browser context and writes them directly to `data/cookies.json` as plaintext. TikTok session cookies are reusable authentication credentials and may allow a party possessing them to assume the authenticated browser session without knowing the account password. The file is created with Python's default file-creation behavior. The code does not enforce restrictive permissions, verify ownership, encrypt the contents, or reject an existing file with unsafe permissions. The file is also located inside the project directory, increasing the possibility of exposure through repository commits, backups, artifact packaging, or access by other local processes. ### Attack Path 1. A user supplies valid TikTok authentication cookies and runs the Skill. 2. The Skill authenticates a Playwright browser context with those cookies. 3. At the end of the run, `save_cookies()` exports the complete browser cookie set. 4. The credentials are written in plaintext to `data/cookies.json` using default filesystem permissions. 5. An unauthorized local process, another user permitted by those filesystem settings, an insecure backup, or an accidental repository publication obtains the file. 6. The exposed cookies are imported into another browser context. 7. If the session remains valid and TikTok does not require additional verification, the attacker can impersonate the authenticated user. ### Impact Assessment Successful exploi ...[truncated 496 chars]
- Remediation
- ## Remediation Suggestions 1. Store cookies outside the project and source-control directories. 2. Create the credential file with owner-only permissions, such as mode `0600` on POSIX systems. 3. Verify file ownership and permissions before reading or overwriting an existing cookie file. 4. Use an operating-system credential manager or encrypted secret store rather than a plaintext JSON file where practical. 5. Write credentials atomically through a securely created temporary file, set restrictive permissions, and then replace the destination. 6. Add `data/cookies.json` and generated credential files to repository ignore and artifact exclusion rules. 7. Restrict imported cookies to explicitly approved TikTok domains. 8. Document how users can revoke active TikTok sessions if the cookie file is exposed.