T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/period_tracker.py:53
- Finding
- Sensitive reproductive-health data is stored without restrictive file permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/period_tracker.py`, lines 53-64 **Vulnerability Type**: Insecure local storage permissions for sensitive health data **Risk Level**: Medium ### Vulnerable Code ```python def load_data() -> dict: DATA_PATH.parent.mkdir(parents=True, exist_ok=True) if not DATA_PATH.exists(): empty = {"version": "1.1", "periods": [], "settings": {"avg_cycle": 28, "avg_duration": 5}} DATA_PATH.write_text(json.dumps(empty, ensure_ascii=False, indent=2)) return empty return json.loads(DATA_PATH.read_text()) def save_data(data: dict): DATA_PATH.parent.mkdir(parents=True, exist_ok=True) DATA_PATH.write_text(json.dumps(data, ensure_ascii=False, indent=2)) ``` ### Technical Analysis The application stores menstrual dates, symptoms, pain levels, mood, flow information, and free-form notes in a plaintext JSON file under the user's home directory. The directory and file are created without explicitly specifying or enforcing restrictive permissions. `Path.write_text()` creates a file using operating-system defaults modified by the process umask. On a system with a permissive umask, the resulting file may be readable by other local users. Existing files with overly broad permissions are also overwritten without correcting their permissions. This is particularly sensitive because the stored information constitutes reproductive and health-related data. Although local plaintext storage is consistent with the documented design, relying only on ambient umask settings does not provide a dependable confidentiality boundary. ### Attack Path 1. A user runs the tracker and records menstrual dates, symptoms, mood information, or notes. 2. The application creates `~/.openclaw/workspace/period_tracker/data.json` with permissions derived from the current process umask. 3. On a permissively configured multi-user system, the file or its parent directories allow another local account to access i ...[truncated 675 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create the data directory with owner-only permissions: ```python DATA_PATH.parent.mkdir(parents=True, exist_ok=True, mode=0o700) DATA_PATH.parent.chmod(0o700) ``` 2. Create data files with mode `0600` rather than relying on the process umask. 3. Correct the permissions of existing files before reading or writing them: ```python if DATA_PATH.exists(): DATA_PATH.chmod(0o600) ``` 4. Use an atomic write procedure: - Create a temporary file in the same protected directory. - Open it with `os.open()` using `O_CREAT | O_EXCL` and mode `0600`. - Write and flush the JSON data. - Replace the destination with `os.replace()`. 5. Document that the file contains sensitive health information and provide a secure deletion option. 6. Consider optional application-level encryption if the threat model includes filesystem compromise or shared device access. ]]>