T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:60
- Finding
- API Credential File May Be Created with Overly Permissive Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 60–63 **Vulnerability Type**: Insecure plaintext credential storage and insufficient file-permission hardening **Risk Level**: Medium **Complete Code Snippet**: ```bash mkdir -p ~/.config/data-go-kr echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_key ``` ### Technical Analysis The documented setup procedure stores the data.go.kr API key in a plaintext file without explicitly restricting permissions on either the containing directory or the credential file. File permissions therefore depend on the user's current `umask`. With a common `umask` of `022`, the directory may be created as mode `755` and the key file as mode `644`. On a multi-user system, these defaults can allow other local users to traverse the directory and read the API credential. Although the placeholder itself is not a hardcoded secret, users are instructed to replace it with a real key. The resulting credential file could consequently expose a valid API credential. ### Attack Path 1. A user follows the setup instructions and replaces `YOUR_API_KEY` with a valid data.go.kr API key. 2. The shell creates `~/.config/data-go-kr/api_key` using the permissions permitted by the user's existing `umask`. 3. If the resulting directory and file are readable by other local accounts, an attacker with local system access reads the file. 4. The attacker copies the API key and uses it to submit unauthorized requests to the associated government-data APIs. 5. The unauthorized requests consume the victim's API quota and may cause service disruption, rate limiting, or account-level consequences. Exploitation requires access through another local account or process that can read the affected user's files; this finding does not independently grant remote access or elevated privileges. ### Impact Assessment The exposed privilege is limited to the access granted by the compromised data.go.kr API key. A succ ...[truncated 411 chars]
- Remediation
- ## Remediation Suggestions Replace the setup commands with permission-safe credential provisioning: ```bash install -d -m 700 "$HOME/.config/data-go-kr" umask 077 printf '%s\n' "YOUR_API_KEY" > "$HOME/.config/data-go-kr/api_key" chmod 600 "$HOME/.config/data-go-kr/api_key" ``` Additional hardening measures: 1. Verify ownership and permissions before reading the key: ```bash test "$(stat -c '%a' "$HOME/.config/data-go-kr/api_key")" = "600" || { echo "Unsafe API key permissions" >&2; exit 1; } ``` 2. Ensure future scripts never print the credential in command output, logs, or error messages. 3. Avoid passing the key directly as a command-line argument, where it could appear in process listings. 4. Prefer an operating-system credential manager or secret store when available. 5. Document credential rotation and revocation procedures for suspected disclosure. 6. Add the credential path and equivalent secret files to source-control ignore rules.