T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:61- Finding
Plaintext Gmail Access Credential Stored Without Restrictive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 61–77
Vulnerability Type: Plaintext sensitive credential storage with potentially permissive file permissions
Risk Level: MediumVulnerable Code Snippet
bash **Recommended:** Save your credentials to `~/.reasonlayer/credentials`: ```bash mkdir -p ~/.reasonlayer echo 'rl_ak_xxx' > ~/.reasonlayer/credentialsThis way you can always find your key later. You can also save it to your memory, environment variables (
REASONLAYER_API_KEY), or wherever you store secrets.
Check for Existing Credentials
Before registering, check if you already have a key:
bash cat ~/.reasonlayer/credentialstext ### Technical Analysis The instructions store a sensitive bearer API key in a plaintext file but do not enforce restrictive directory or file permissions. With a common `022` process umask, `mkdir -p` can create the directory with mode `0755`, while shell redirection can create the credential file with mode `0644`. On a multi-user system, other local users may therefore be able to read the token. The use of `cat` also writes the credential directly to standard output. This can expose it through terminal capture, agent transcripts, debugging logs, shell automation, or other output-recording systems. The alternative suggestion to save the key in agent memory unnecessarily broadens the number of places where the secret may persist. The document states that the key grants access to the connected Gmail account through Reasonlayer. Consequently, possession of the key may enable Gmail-reading and email-sending operations within the OAuth permissions granted by the user. ### Attack Path 1. A user follows the documented commands to save the Reasonlayer API key. 2. The shell creates `~/.reasonlayer/credentials` according to the current umask, potentially resulting in a world-readable `0644` file. 3. Another local user or a compromised process reads the file, or the credential is capt ...[truncated 986 chars]- Remediation
View remediation
Remediation Suggestions
Create the credential directory and file with explicitly restrictive permissions rather than relying on the user's umask:
bash install -d -m 700 ~/.reasonlayer umask 077 printf '%s\n' 'rl_ak_xxx' > ~/.reasonlayer/credentials chmod 600 ~/.reasonlayer/credentialsAdditional hardening measures should include:
- Prefer an operating-system credential manager or secret store instead of a plaintext file.
- Do not recommend persistent agent memory as a credential-storage location.
- Avoid printing the token with
cat; load it directly into the required process while preventing command tracing and log capture. - Document token revocation and rotation procedures for suspected disclosure.
- Redact bearer tokens from application logs, agent transcripts, diagnostics, and error messages.
- Use narrowly scoped OAuth authorization. Separate read-only and send permissions where supported, and request send access only when required.
- Require explicit user authorization before each email-sending operation.
- Consider short-lived credentials or scoped delegated tokens instead of a long-lived bearer key with all connected Gmail capabilities.