T09 · Insecure Skill Coding Practices
- Location
scripts/setup.sh:31- Finding
Sensitive task data and exports are created without restrictive permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup.sh:31-61;scripts/export-tasks.sh:29-30, 82, 108-114
Vulnerability Type: Insecure file and directory permissions
Risk Level: MediumVulnerable Code
scripts/setup.sh:31-61:bash # Create data directory if [ -d "$DATA_DIR" ]; then echo "📁 Data directory already exists: $DATA_DIR" else mkdir -p "$DATA_DIR/archive" echo "📁 Created data directory: $DATA_DIR" fi # Initialize tasks.json if [ ! -f "$DATA_DIR/tasks.json" ]; then echo "[]" > "$DATA_DIR/tasks.json" echo "📋 Initialized tasks.json" else TASK_COUNT=$(jq 'length' "$DATA_DIR/tasks.json") echo "📋 tasks.json exists ($TASK_COUNT tasks)" fi # Initialize projects.json if [ ! -f "$DATA_DIR/projects.json" ]; then echo "[]" > "$DATA_DIR/projects.json" echo "📁 Initialized projects.json" else PROJECT_COUNT=$(jq 'length' "$DATA_DIR/projects.json") echo "📁 projects.json exists ($PROJECT_COUNT projects)" fi # Initialize check-in log if [ ! -f "$DATA_DIR/check-in-log.json" ]; then echo "[]" > "$DATA_DIR/check-in-log.json" echo "📝 Initialized check-in-log.json" else echo "📝 check-in-log.json exists" fi # Ensure archive directory exists mkdir -p "$DATA_DIR/archive"scripts/export-tasks.sh:29-30, 82, 108-114:bash # Ensure export directory mkdir -p "$(dirname "$OUTPUT")"bash } > "$OUTPUT" echo "✅ Exported $TASK_COUNT tasks to $OUTPUT"bash json) OUTPUT="${OUTPUT}.json" jq '.' "$TASKS_FILE" > "$OUTPUT" echo "✅ Exported $TASK_COUNT tasks to $OUTPUT" ;;Technical Analysis
The scripts do not set a restrictive process
umaskand do not explicitly assign secure modes to newly created directories or files. Consequently, permissions are inherited from the caller's environment. Under a co ...[truncated 1684 chars]- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive umask at the beginning of every script that creates or rewrites sensitive data:
bash umask 077 -
Explicitly create the data and archive directories with mode
0700:bash install -d -m 0700 "$DATA_DIR" "$DATA_DIR/archive" -
Create task databases, logs, archives, temporary files, and exports with mode
0600. -
Validate and repair permissions on existing installations:
bash chmod 700 "$DATA_DIR" "$DATA_DIR/archive" find "$DATA_DIR" -type f -exec chmod 600 {} \; -
Preserve restrictive permissions when replacing files through temporary-file and
mvoperations. -
Warn users when an export destination is outside the protected data directory.
-
Consider rejecting export destinations located in shared or world-writable directories unless the user explicitly confirms the risk.
-