T09 · Insecure Skill Coding Practices
- Location
scripts/fitness_skill.py:32- Finding
Sensitive Health Data Stored with Permissive Default Filesystem Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fitness_skill.py:32-38,scripts/fitness_skill.py:51-54, andscripts/fitness_skill.py:554-560
Vulnerability Type: Insecure local storage permissions
Risk Level: MediumVulnerable Code
python def _ensure_data_dir(): os.makedirs(_DATA_DIR, exist_ok=True) def _ensure_export_dir(): os.makedirs(EXPORT_DIR, exist_ok=True)python def _write_json(path: str, data: dict): _ensure_data_dir() with open(path, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2)python def export_to_file(self, days: int = 30, max_entries: int = 50) -> str: """Write the Markdown report to a file and return the path.""" _ensure_export_dir() md = self.export_log_markdown(days, max_entries) fname = f"fitness-log-{date.today().isoformat()}.md" path = os.path.join(EXPORT_DIR, fname) with open(path, "w", encoding="utf-8") as f: f.write(md) return pathTechnical Analysis
The application stores fitness plans, workout history, physical constraints, feelings, session notes, and report exports beneath
~/.openclaw/workspace/fitness-skill/. This information may constitute sensitive health-related data.The directories and files are created without explicit restrictive modes. Their effective permissions therefore depend on the process umask. With a common
022umask, newly created directories may receive mode0755and files may receive mode0644. On a multi-user system, another local account may consequently be able to read these records if all parent directories are traversable.The same weakness affects plan, log, active-session, and exported Markdown files because they share these creation helpers or equivalent unprotected writes.
Attack Path
- The victim creates a plan, records workouts, starts a live session, or exports a report.
- The skill creates directories and files using process-default permissi ...[truncated 962 chars]
- Remediation
View remediation
Remediation Suggestions
- Create sensitive data directories with owner-only permissions:
python def _ensure_data_dir(): os.makedirs(_DATA_DIR, mode=0o700, exist_ok=True) os.chmod(_DATA_DIR, 0o700) def _ensure_export_dir(): os.makedirs(EXPORT_DIR, mode=0o700, exist_ok=True) os.chmod(EXPORT_DIR, 0o700)-
Write files atomically with mode
0600. Create a temporary file in the destination directory usingos.openwith restrictive flags and permissions, flush and optionallyfsyncit, then replace the destination withos.replace. -
Explicitly apply
os.chmod(path, 0o600)to existing destination files because the creation mode alone does not correct previously created permissive files. -
Add a migration step that audits and repairs permissions on
plan.json,log.json,active_session.json, and existing Markdown exports. -
Avoid relying solely on the process umask. Consider encrypted storage if the threat model includes privileged local attackers, untrusted backups, or filesystem theft.