T09 · Insecure Skill Coding Practices
- Location
production_team_storyteller.py:28- Finding
Potentially Sensitive Oral-History Records Stored in Plaintext with Ambient File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
production_team_storyteller.py, lines 28–41
Vulnerability Type: Plaintext storage of potentially sensitive personal data
Risk Level: Mediumpython def save_raw_memory(self, content, tags): """ 保存原始口述记录，带上时间戳和标签，方便后续翻查。 """ timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") filename = f"{self.data_dir}/memory_{timestamp}.json" data = { "timestamp": timestamp, "content": content, "tags": tags, "status": "raw" } with open(filename, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=4) return f"已存入素材库，编号：{timestamp}"Technical Analysis
The
save_raw_memorymethod writes oral-history content and associated tags directly to an unencrypted JSON file. Such records may contain names, relationships, personal experiences, political or historical recollections, and other sensitive family information.The file is created through Python's ordinary
open(..., 'w')operation without explicitly enforcing restrictive permissions. Its effective permissions therefore depend on the process umask and surrounding directory permissions. The containing directory is likewise created without an explicit private mode elsewhere in the class. No encryption, redaction, consent control, access-control validation, or retention mechanism protects the stored information.This does not grant an attacker new system privileges. Exploitation requires an existing local user or process to have access to the storage directory or files, such as through permissive filesystem settings, a shared working directory, backup exposure, or another compromised process.
Attack Path
- A user records an oral-history segment containing sensitive personal or family information.
- The skill serializes the complete content and tag ...[truncated 1013 chars]
- Remediation
View remediation
Remediation Suggestions
- Create the storage directory with owner-only permissions such as
0700, and verify that an existing directory is neither a symbolic link nor accessible to unintended users. - Create each record atomically with owner-only permissions such as
0600, using low-level flags includingO_CREAT,O_EXCL, andO_NOFOLLOWwhere supported. - Resolve and validate the destination path before writing, particularly when
data_dircan be supplied by a caller. - Encrypt sensitive records at rest using a vetted authenticated-encryption implementation, with keys stored separately from the data.
- Provide redaction controls so users can remove names and other identifying details before storage.
- Inform users that personal narratives will be stored, obtain appropriate consent, and define retention and deletion controls.
- Prevent filename collisions by adding microseconds or a securely generated unique identifier, and use atomic writes to avoid accidental replacement or partial records.
- Review backup, synchronization, and logging behavior to ensure stored narratives are not copied into less-protected locations.
- Create the storage directory with owner-only permissions such as