T09 · Insecure Skill Coding Practices
- Location
scripts/flomo.sh:9- Finding
Unprotected Webhook Credential and Unrestricted Request Destination
- Content
View full analysis
Vulnerability Details
File Location:
scripts/flomo.sh, lines 9–20
Vulnerability Type: Unprotected sensitive configuration and insufficient destination validation
Risk Level: MediumVulnerable Code
bash WEBHOOK_URL=$(cat ~/.flomo_token) CONTENT="$1" if [ -z "$CONTENT" ]; then exit 1 fi response=$(curl -s -X POST -H "Content-Type: application/json" -d "$(jq -n --arg content "$CONTENT" '{"content": $content}')" "$WEBHOOK_URL")The associated configuration instructions in
SKILL.md, line 8, direct users to store the webhook URL in~/.flomo_tokenwithout requiring restrictive file permissions.Technical Analysis
The webhook URL is a bearer credential because possession of the complete URL can permit requests to the associated flomo account. The script reads this credential from a plaintext file without checking whether the file is owned by the current user or accessible to group and other users.
The value read from the file is also used directly as the
curldestination. The script does not require HTTPS or verify that the destination belongs to an expected flomo domain. Although the URL is quoted and therefore does not directly provide shell command injection, modification of the configuration file can redirect note contents to an attacker-controlled server.Attack Path
- An attacker with local read access obtains
~/.flomo_tokenif it was created with permissive permissions. - The attacker reuses the exposed bearer URL to submit unauthorized content to the victim's flomo account.
Alternatively:
- An attacker with permission to modify
~/.flomo_tokenreplaces the legitimate URL with an attacker-controlled endpoint. - The user invokes the skill with private note content.
- The script reads the modified URL without validating its scheme or hostname.
curlsends the note content to the attacker's endpoint.
Impact Assessment
Exploitation does not ...[truncated 313 chars]
- An attacker with local read access obtains
- Remediation
View remediation
Remediation Suggestions
- Require the token file to be owned by the current user and reject symbolic links or files with group or other permissions.
- Document secure creation and enforce mode
0600, for example withchmod 600 "$HOME/.flomo_token". - Validate that the configured URL uses
https://and matches the officially supported flomo webhook hostname and path structure. - Invoke curl with transport and HTTP failure controls, such as
--proto '=https',--fail-with-body, and--show-error. - Use
--before the validated URL to mark the end of command options. - Consider storing the webhook in an operating-system credential manager rather than a plaintext file.
- Avoid displaying or logging the webhook URL, and provide credential-rotation instructions for suspected disclosure.