T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/resy-auth.sh:13- Finding
Authentication Tokens and Browser Session State Are Stored Without Explicit Access Restrictions
- Content
View full analysis
"$TOKEN_FILE" ``` From `scripts/opentable-login.js`: ```javascript const DATA_DIR = path.join(process.env.HOME, '.openclaw/data/resy-hunter'); const SESSION_FILE = path.join(DATA_DIR, 'opentable-session.json'); async function main() { fs.mkdirSync(DATA_DIR, { recursive: true }); ``` ```javascript // Save session await context.storageState({ path: SESSION_FILE }); ``` From `scripts/opentable-check.js`: ```javascript // Refresh session for next run try { await context.storageState({ path: SESSION_FILE }); } catch (e) { // Non-critical } ``` ### Technical Analysis The Resy bearer token and OpenTable Playwright storage state are deliberately persisted so scheduled monitoring can run without interactive authentication. This persistence is functionally justified, but the implementation does not enforce owner-only permissions. The Resy token is written through ordinary shell redirection, while the OpenTable state is written by Playwright. The directory is created with the process's default permissions, and no restrictive `umask`, `chmod`, explicit file mode, or symbolic-link protection is applied. Consequently, the actual protection depends on the invoking environment's umask ...[truncated 1734 chars]- Remediation
View remediation
"$tmp_file" mv -f "$tmp_file" "$TOKEN_FILE" chmod 600 "$TOKEN_FILE" ``` 3. In JavaScript, create the directory with mode `0700` and apply mode `0600` after Playwright writes the state: ```javascript fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 }); await context.storageState({ path: SESSION_FILE }); fs.chmodSync(SESSION_FILE, 0o600); ``` 4. Reject symbolic links before reading, migrating, or overwriting sensitive files by using `lstat` and verifying that the destination is a regular file in the expected directory. 5. Avoid copying a legacy token unless the source and destination are regular, owner-controlled files. Reapply restrictive permissions after migration. 6. Document the sensitivity, expiration, revocation, and secure-deletion procedures for both state files. Prefer an operating-system credential store where available. ]]>