T09 · Insecure Skill Coding Practices
- Location
SKILL.md:17- Finding
Administrative Shopify Tokens Stored in an Undocumented Local Cache
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17-18 and 52-60
Vulnerability Type: Insecure local storage of sensitive credentials and administrative tokens
Risk Level: MediumRelevant snippet (English translation of the audited documentation):
markdown 1. `setup once`: Use `ICOSMOS_USER_EMAIL` / `ICOSMOS_USER_PASSWORD` to synchronize stores and tokens into a local cache. - Setup Once: - `ICOSMOS_USER_EMAIL` - `ICOSMOS_USER_PASSWORD` Both fields must be stored in system environment variables. The required command-line tool is `icosmos-shopify` in the current directory.Technical Analysis
The documented setup workflow reads account credentials from environment variables, retrieves Shopify tokens through Supabase, and persists the resulting tokens in a local cache. The documentation does not define:
- The location or ownership of the cache.
- Required filesystem permissions.
- Whether tokens are encrypted at rest.
- Token retention, expiration, rotation, or deletion behavior.
- Protections against inclusion in backups, diagnostic archives, or source-control commits.
- Whether account passwords are removed from the process environment after setup.
- Whether sensitive values can be exposed through process inheritance, crash reports, or debug logs.
Shopify administrative tokens can provide access to store configuration, products, orders, blogs, and potentially customer information, depending on their granted scopes. Storing such tokens without an explicit secure-storage design creates a credential-disclosure risk.
The project contains only
SKILL.md; the referencedicosmos-shopifyexecutable is absent. Consequently, the implementation of the cache, Supabase communication, token redaction, and file-permission controls could not be verified. This finding is therefore based on the documented security design rather than confirmation of a specific world-readable ca ...[truncated 1498 chars]- Remediation
View remediation
Remediation Suggestions
- Store Shopify tokens in an operating-system credential manager or dedicated secret-management service rather than an ordinary plaintext cache.
- If a local file is unavoidable, create it in a private user directory with restrictive permissions, such as owner-only read and write access, and reject unsafe ownership or permission states.
- Encrypt cached tokens at rest using a key that is not stored alongside the encrypted data.
- Do not persist
ICOSMOS_USER_PASSWORD; use it only for initial authentication and remove it from the process environment as soon as practical. - Prefer short-lived credentials and implement explicit expiration, rotation, revocation, and secure deletion procedures.
- Document the exact cache location, format, permissions, retention period, and cleanup command.
- Prevent the cache from being included in source control, backups, support bundles, telemetry, crash reports, and command output.
- Apply least-privilege Shopify scopes and use separate tokens for read-only auditing and confirmed publishing operations.
- Ensure logs redact complete credentials, authorization headers, environment values, and cache contents. Partial redaction should not be the sole protection.
- Include the
icosmos-shopifyimplementation or reproducible source in the audited package so its authentication, storage, TLS validation, logging, and permission controls can be independently reviewed.