T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/get_token.py:89
- Finding
- Feishu credentials and access tokens are stored in plaintext without enforced file permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_token.py:89-98`; related credential-creation guidance at `SKILL.md:41-44` **Vulnerability Type**: Plaintext sensitive-data storage and missing access-control hardening **Risk Level**: Medium ### Vulnerable Code ```python def save_token_cache(token, expire_seconds): """保存 token 缓存""" ENV_DIR.mkdir(parents=True, exist_ok=True) cache_data = { "tenant_access_token": token, "expires_at": time.time() + expire_seconds } TOKEN_CACHE.write_text(json.dumps(cache_data, indent=2)) ``` The setup instructions also direct users to create a plaintext credential file: ```bash # Configure authentication (one-time setup) cd scripts/env echo '{"app_id": "your_app_id", "app_secret": "your_app_secret"}' > app.json ``` ### Technical Analysis The application secret is stored in `scripts/env/app.json`, and the resulting tenant access token is stored in `scripts/env/token_cache.json`. Both are plaintext files. `Path.write_text()` creates the token cache using permissions derived from the process umask. The code does not explicitly enforce owner-only permissions such as `0600`, does not securely create the file, and does not use a secret-management facility. The development documentation claims that `scripts/.gitignore` protects `app.json` and `token_cache.json`, but no such file is present in the audited project. This increases the chance that credentials will be committed to version control or included in an archive. The network transmission of `app_id` and `app_secret` itself is expected and necessary: it uses HTTPS and targets the declared official Feishu endpoint. The finding concerns local storage rather than evidence of exfiltration. ### Attack Path 1. A user follows the setup instructions and creates `scripts/env/app.json`. 2. `get_token.py` obtains a tenant token and writes it to `scripts/env/token_cache.json`. 3. The files inherit ambient filesystem permissions ins ...[truncated 948 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce owner-only permissions when creating or updating secret files: - Create files using `os.open()` with mode `0o600`. - Apply `chmod(0o600)` to existing credential and token files. 2. Write the cache atomically: - Create a protected temporary file in the same directory. - Flush and synchronize it. - Atomically replace the old cache with `os.replace()`. 3. Add repository ignore rules for: ```gitignore scripts/env/app.json scripts/env/token_cache.json ``` 4. Store the application secret in an operating-system credential store, secret manager, or protected environment variable rather than a project-directory JSON file. 5. Document and verify the minimum Feishu scopes required to list group members. 6. Add startup checks that reject credential or cache files readable by group or other users. 7. Rotate the application secret and revoke cached tokens immediately if either file has entered source control, logs, backups, or distributed artifacts. ]]>