T09 · Insecure Skill Coding Practices
- Location
SKILL.md:60- Finding
API Credential File May Be Created with Overly Permissive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 60–63
Vulnerability Type: Insecure plaintext credential storage and insufficient file-permission hardening
Risk Level: MediumComplete Code Snippet:
bash mkdir -p ~/.config/data-go-kr echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_keyTechnical Analysis
The documented setup procedure stores the data.go.kr API key in a plaintext file without explicitly restricting permissions on either the containing directory or the credential file.
File permissions therefore depend on the user's current
umask. With a commonumaskof022, the directory may be created as mode755and the key file as mode644. On a multi-user system, these defaults can allow other local users to traverse the directory and read the API credential.Although the placeholder itself is not a hardcoded secret, users are instructed to replace it with a real key. The resulting credential file could consequently expose a valid API credential.
Attack Path
- A user follows the setup instructions and replaces
YOUR_API_KEYwith a valid data.go.kr API key. - The shell creates
~/.config/data-go-kr/api_keyusing the permissions permitted by the user's existingumask. - If the resulting directory and file are readable by other local accounts, an attacker with local system access reads the file.
- The attacker copies the API key and uses it to submit unauthorized requests to the associated government-data APIs.
- The unauthorized requests consume the victim's API quota and may cause service disruption, rate limiting, or account-level consequences.
Exploitation requires access through another local account or process that can read the affected user's files; this finding does not independently grant remote access or elevated privileges.
Impact Assessment
The exposed privilege is limited to the access granted by the compromised data.go.kr API key. A succ ...[truncated 411 chars]
- A user follows the setup instructions and replaces
- Remediation
View remediation
Remediation Suggestions
Replace the setup commands with permission-safe credential provisioning:
bash install -d -m 700 "$HOME/.config/data-go-kr" umask 077 printf '%s\n' "YOUR_API_KEY" > "$HOME/.config/data-go-kr/api_key" chmod 600 "$HOME/.config/data-go-kr/api_key"Additional hardening measures:
- Verify ownership and permissions before reading the key:
bash test "$(stat -c '%a' "$HOME/.config/data-go-kr/api_key")" = "600" || { echo "Unsafe API key permissions" >&2; exit 1; } - Ensure future scripts never print the credential in command output, logs, or error messages.
- Avoid passing the key directly as a command-line argument, where it could appear in process listings.
- Prefer an operating-system credential manager or secret store when available.
- Document credential rotation and revocation procedures for suspected disclosure.
- Add the credential path and equivalent secret files to source-control ignore rules.
- Verify ownership and permissions before reading the key: