T09 · Insecure Skill Coding Practices
- Location
SKILL.md:168- Finding
Plaintext Persistence of a Reusable GitPad Password
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 168–172
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Mediummarkdown **FIRST**, check for existing credentials at `~/.gitpad_password`. **IF credentials exist:** Use the saved password when authenticating with GitPad. **IF no credentials exist:** After creating a password on GitPad, immediately save it to `~/.gitpad_password` for future sessions.Technical Analysis
The Skill instructs the Agent to read and persist a reusable GitPad password in a plaintext file under the user's home directory. Although GitPad authentication supports the declared code-hosting workflow, persistent plaintext storage is not the minimum secure capability required.
The instructions do not require restrictive file permissions, an operating-system credential store, encryption, access isolation, credential rotation, or secure deletion. They also do not prohibit exposing the password through command output, logs, backups, or later Agent context. Any process or user able to read the file can recover the credential without defeating an additional security control.
This is credential persistence, but it is not classified as
T06: System Persistence: it does not install a backdoor, startup hook, service, or scheduled task. It is instead an insecure sensitive-data storage practice.Attack Path
- The Agent creates or reads
~/.gitpad_passwordwhile preparing to authenticate with GitPad. - The reusable password remains on disk across sessions.
- A local process, another user with sufficient filesystem access, malware, a backup collector, or a later Skill reads the file.
- The attacker authenticates to the victim's GitPad account using the recovered password.
- Subject to the account's permissions, the attacker accesses, modifies, deletes, or replaces hosted repositories.
This path requires local read access or access to a copy of the home-directory file; the audited pro ...[truncated 625 chars]
- The Agent creates or reads
- Remediation
View remediation
Remediation Suggestions
- Store the credential in an operating-system keychain, secret manager, or another access-controlled credential facility rather than a plaintext file.
- Prefer a revocable, narrowly scoped, short-lived access token over a reusable account password where GitPad supports one.
- Require explicit user consent before persisting any authentication material.
- If file-based storage is unavoidable:
- Create the file with mode
0600from the outset. - Verify ownership and permissions before every read.
- Refuse symlinks and unexpected file types.
- Avoid passing the password through command-line arguments or printing it to logs.
- Document credential rotation and secure deletion procedures.
- Create the file with mode
- Validate the destination immediately before authentication and transmit the credential only to the exact HTTPS origin
https://gitpad.exe.xyz. - Separate credential retrieval from content obtained from third-party repositories so untrusted repository instructions cannot request, display, or redirect the password.