T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/freesound_config.py:23
- Finding
- OAuth Tokens and Client Secrets Stored Without Explicit Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/freesound_config.py`, lines 23–26 **Vulnerability Type**: Plaintext credential storage with inherited file permissions **Risk Level**: Medium ### Vulnerable Code ```python def save_config(data: dict) -> None: ensure_app_dir() CONFIG_PATH.write_text(json.dumps(data, indent=2), encoding="utf-8") ``` ### Technical Analysis The configuration object contains the Freesound client secret and, after OAuth authentication, access-token data. `save_config()` serializes this sensitive data into a plaintext JSON file. The file is created without explicitly enforcing owner-only permissions or validating the inherited directory ACL. Its effective access controls therefore depend on the operating system, current process umask, and inherited permissions on the parent directory. On a shared or incorrectly configured system, another local account or process may be able to read the credentials. The local storage is necessary for the declared functionality, but storing reusable secrets in plaintext without enforcing restrictive access controls exceeds the minimum safe privilege model. ### Attack Path 1. The user runs `setup_credentials.py` or `oauth_login.py`. 2. `save_config()` writes the client secret and OAuth token to `credentials.json`. 3. The file inherits permissive filesystem permissions or ACL entries. 4. A local attacker or compromised process reads the JSON file. 5. The attacker extracts the OAuth access token, refresh token if returned, or Freesound client secret. 6. The stolen credential is reused to make authenticated Freesound API requests. ### Impact Assessment Successful exploitation can expose all credentials stored in the configuration file. An attacker may obtain the same Freesound API access granted to the authenticated user, subject to the token's scope and server-side permissions. This issue does not directly provide operating-system privilege escalation. Its scope is credential ...[truncated 94 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Prefer an operating-system credential manager, such as Windows Credential Manager, rather than a plaintext JSON file. - If file storage is required, create the directory and file with owner-only access. - On POSIX systems, use mode `0700` for the directory and `0600` for the credential file. - On Windows, apply and verify an ACL that grants access only to the current user and required system principals. - Write credentials atomically through a securely created temporary file, apply restrictive permissions, and then replace the destination file. - Validate existing permissions during every load and refuse to use a credential file that is accessible to unintended users. - Store only credentials required for current operation and provide a secure command to delete or revoke stored tokens. ]]>