T09 · Insecure Skill Coding Practices
Error
- Location
src/config.js:128- Finding
OAuth Tokens Are Stored Without Restrictive File Permissions
- Content
View full analysis
0) { toSave.expires_at = Date.now() + (expiresIn * 1000); } } fs.writeFileSync(tokenPath, JSON.stringify(toSave, null, 2)); } ``` ### Technical Analysis The Skill persists Microsoft OAuth access and refresh tokens using `fs.writeFileSync` without specifying a restrictive file mode. The effective permissions therefore depend on the process umask. On systems with a common `0022` umask, a newly created token file may have mode `0644`, making it readable by other local users. The stored refresh token is a long-lived reusable credential. An attacker who reads it can submit it to Microsoft's OAuth token endpoint and obtain new access tokens without knowing the user's password. The resulting privileges include every delegated scope granted to the application. The implementation also does not verify whether the destination file is a symbolic link, whether it is owned by the current user, or whether an existing file has secure permissions before reading or overwriting it. ### Attack Path 1. A victim authenticates through the device-code flow. 2. The Skill writes the token response to `~/.openclaw/credentials/ms365.tokens.<account>.json`. 3. The token file inherits permissions from the process umask and may be readable by another local account or compromise ...[truncated 938 chars]- Remediation
View remediation