T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sentinel-output.sh:297- Finding
Detected sensitive content is persisted in plaintext audit logs
- Content
View full analysis
> "$SENTINEL_LOG" 2>/dev/null || true fi ``` `scripts/sentinel-output.sh:297-301`: ```bash if [[ $THREAT_COUNT -gt 0 ]]; then mkdir -p "$(dirname "$SENTINEL_LOG")" SNIPPET=$(echo "$INPUT" | head -c 200 | tr '\n' ' ') LOG_ENTRY="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"direction\":\"output\",\"severity\":\"$SEVERITY\",\"categories\":\"$CAT_STRING\",\"threat_count\":$THREAT_COUNT,\"snippet\":\"$(echo "$SNIPPET" | sed 's/"/\\"/g')\"}" echo "$LOG_ENTRY" >> "$SENTINEL_LOG" 2>/dev/null || true fi ``` ### Technical Analysis The input and output scanners are specifically intended to detect credentials, private keys, tokens, database connection strings, and other confidential content. When a threat is found, both scanners copy the first 200 characters of the original content into `~/.sentinel/threats.jsonl` by default. Consequently, if sensitive material appears within the first 200 characters, the scanner creates a second plaintext copy of the material it was intended to protect. The code creates the log directory and file without setting an explicit restrictive `umask` or applying `0700` and `0600` permissions. Actual exposure depends on the invoking process's existing `umask`, directory permissions, backup poli ...[truncated 1640 chars]- Remediation
View remediation