T09 · Insecure Skill Coding Practices
Warning
- Location
- lib/logger.js:20
- Finding
- Raw Customer Data Stored and Printed Without Adequate Protection<![CDATA[ ## Vulnerability Details **File Location**: `lib/logger.js:20-39`; related defaults and output paths in `config/template.json:41-45`, `scripts/monitor.js:96-97`, `scripts/respond.js:26-29`, and `scripts/escalate.js:22-25` **Vulnerability Type**: Plaintext storage and disclosure of sensitive customer data **Risk Level**: Medium ### Vulnerable Code ```javascript log(entry) { if (!this.config.logging.enabled) return; const date = new Date().toISOString().split('T')[0]; // YYYY-MM-DD const dayDir = path.join(this.logDir, date); const logFile = path.join(dayDir, `${this.clientId}.jsonl`); // Create directory if (!fs.existsSync(dayDir)) { fs.mkdirSync(dayDir, { recursive: true }); } // Write log entry const logEntry = { timestamp: new Date().toISOString(), ...entry }; fs.appendFileSync(logFile, JSON.stringify(logEntry) + '\n', 'utf-8'); } ``` Logging is enabled for 90 days by default: ```json "logging": { "enabled": true, "logDir": "./logs", "retentionDays": 90 } ``` Raw identifiers and message contents are also printed: ```javascript console.log(`\n📨 New message from ${msg.user} (${channelName})`); console.log(` "${msg.message}"`); ``` ### Technical Analysis The logger writes the complete entry object to an unencrypted JSONL file. Callers populate that object with raw customer identifiers, message contents, generated responses, channel names, and escalation details. The implementation does not redact sensitive values, pseudonymize identifiers, detect secrets, encrypt transcripts, or explicitly create files with restrictive permissions. The same customer data is emitted to standard output in the monitor, manual response, and escalation paths. The documented PM2 deployment model may retain this output in process-manager logs independently of the application's configured retention period. Although the documentation tells operators not to store sensitive information, the implementation cannot guarantee th ...[truncated 1352 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable full-message logging by default and log only operational metadata necessary for aggregate reporting. 2. Apply centralized redaction before both file logging and console output. Cover payment-card data, credentials, tokens, email addresses, telephone numbers, and government identifiers. 3. Pseudonymize customer identifiers using a keyed hash when correlation is necessary. 4. Create the log directory and files with restrictive permissions, such as owner-only directory and file access. 5. Encrypt full transcripts at rest when a documented business requirement requires their retention. 6. Reduce the default retention period and make full transcript retention explicitly opt-in. 7. Ensure PM2 and other process-manager logs have equivalent access controls, redaction, rotation, and retention limits. 8. Separate aggregate analytics from raw transcript storage so the dashboard does not require retaining message bodies. 9. Document incident-response and deletion procedures for customer data. ]]>