T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:60
- Finding
- Sensitive API Token Collection Through Chat and Insecure Plaintext Storage## Vulnerability Details **File Location**: `SKILL.md`, lines 60 and 66–74; the same insecure update pattern is repeated at lines 96–113 **Vulnerability Type**: Sensitive credential exposure and insecure local secret storage **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.config/meituan-travel cat > ~/.config/meituan-travel/config.json << 'EOF' { "key": "<user-provided-token>" } EOF ``` The surrounding instructions require the user to send the token to the agent through the conversation so that it can be inserted into this file. The token-replacement flow repeats the same behavior for newly issued tokens. ### Technical Analysis The skill treats an API token as conversational input. Consequently, the plaintext credential may enter chat transcripts, agent execution logs, telemetry, support records, or backups outside the user's direct control. This conflicts with the document's own statement that the token is a highly sensitive credential. The token is subsequently written as plaintext to `~/.config/meituan-travel/config.json`. Although the parent directory is created first, neither the directory nor the file is assigned an explicit restrictive permission mode. The resulting permissions depend on the process umask and existing filesystem state. On a permissively configured or shared system, another local account or process may be able to read the credential. The shell redirection also replaces the destination directly rather than using a securely created temporary file followed by an atomic rename. Existing files or symbolic links are not validated before replacement, creating additional risk when the configuration path can be manipulated by another local actor. ### Attack Path 1. A user follows the skill instructions and sends a valid API token as a plaintext chat message. 2. The token is retained in conversation history, execution telemetry, or another logging system. 3. An actor with ...[truncated 1113 chars]
- Remediation
- ## Remediation Suggestions 1. Do not request API tokens through normal chat messages. 2. Use a dedicated secret-entry interface that masks input and excludes values from transcripts, telemetry, and logs. 3. Prefer an operating-system credential store or managed secret service instead of a plaintext JSON file. 4. If file storage is unavoidable, create the directory with mode `0700` and the credential file with mode `0600`. 5. Create the file securely and atomically, reject symbolic links, and validate file ownership before reading or replacing it. 6. Ensure the CLI and agent never print the token in command output, diagnostics, or exception messages. 7. Provide token revocation and rotation guidance, especially after accidental disclosure. 8. Minimize token permissions, scope, and lifetime so that compromise has limited impact.