T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:54
- Finding
- Unnecessary Persistence of the Meta App Secret with Delayed Permission Hardening<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-67 **Vulnerability Type**: Unnecessary plaintext secret persistence and non-atomic access-control hardening **Risk Level**: Medium ### Complete Code Snippet ```powershell # 3. Save - only these four fields @{ IG_USER_ID = $igUserId IG_ACCESS_TOKEN = $longToken IG_APP_ID = $appId IG_APP_SECRET = $appSecret } | ConvertTo-Json | Set-Content "$HOME/.config/instagram-page/credentials.json" -Encoding UTF8 ``` ```powershell # Windows icacls "$HOME/.config/instagram-page/credentials.json" /inheritance:r /grant:r "$($env:USERNAME):(R,W)" # macOS / Linux # chmod 600 ~/.config/instagram-page/credentials.json ``` The associated metadata also declares the sensitive credential file and optional app-secret field at `_meta.json`, lines 18-45. ### Technical Analysis The setup procedure writes `IG_APP_SECRET` to the persistent runtime credential file even though the Skill explicitly states that this value is needed only during the one-time token exchange. Routine API operations require only `IG_ACCESS_TOKEN` and `IG_USER_ID`, so persisting the app secret exceeds the minimum credential set necessary for runtime operation. The file is created before its permissions are restricted. Permission hardening is performed as a separate command, which creates an exposure window if the command is delayed, omitted, or fails. On macOS and Linux, the supplied `chmod` command is commented out and therefore is not executed as part of the shown setup block. The metadata correctly marks the file as sensitive and the app secret as optional, but it does not mitigate the unsafe persistence instruction in `SKILL.md`. ### Attack Path 1. A user follows the documented token-exchange procedure. 2. PowerShell writes the long-lived access token and Meta app secret to `~/.config/instagram-page/credentials.json`. 3. The file initially receives permissions according to the platform and environmen ...[truncated 1065 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never persist `IG_APP_SECRET` or `IG_APP_ID` in the runtime credential file. Save only the values required during normal operation: ```powershell @{ IG_USER_ID = $igUserId IG_ACCESS_TOKEN = $longToken } | ConvertTo-Json ``` 2. Create the credential directory and file with restrictive permissions before or atomically with writing sensitive data. 3. On macOS and Linux, set a restrictive `umask`, create the file with owner-only access, and verify that its final mode is `0600`. 4. On Windows, create or preconfigure the file with inheritance disabled and access limited to the current user before storing credentials. 5. Check command exit status and inspect the resulting ACL or file mode. Abort setup if restrictive permissions cannot be established. 6. Keep the app secret only in a temporary in-memory variable during exchange, clear it afterward, and avoid writing it to logs or command output. 7. Update `_meta.json` so the primary runtime credential schema contains only `IG_ACCESS_TOKEN` and `IG_USER_ID`; document setup-only values separately. 8. Rotate the app secret and access token if they were previously stored in a file with uncertain permissions. ]]>