T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/auth.py:47
- Finding
- Unnecessary Persistence of Access Tokens and Account Metadata## Vulnerability Details **File Location**: `scripts/auth.py`, lines 47–64 **Vulnerability Type**: Excessive sensitive-data persistence **Risk Level**: Medium ```python api_keys = data.get("api_keys", []) api_key = api_keys[0] if api_keys else "" creds = { "uid": data.get("uid", ""), "api_key": api_key, "email": data.get("email", ""), "name": data.get("name", ""), "team_id": data.get("team_id", ""), "role": data.get("role", ""), "charge_type": data.get("charge_type", ""), "remain_credit": data.get("remain_credit"), "created_at": datetime.now(timezone.utc).isoformat(), } if data.get("access_token"): creds["access_token"] = data["access_token"] creds["token_type"] = data.get("token_type", "Bearer") ``` ### Technical Analysis The authentication workflow persists substantially more information than the runtime API client requires. `scripts/shared/config.py` only retrieves `uid` and `api_key` from the credential file, while `auth.py` additionally stores: - Email address and display name - Team identifier and account role - Billing type and remaining credit balance - OAuth access token and token type Persisting unused sensitive fields violates data-minimization and least-privilege principles. In particular, storing an access token creates an additional reusable credential whose scope, expiration, and revocation behavior are not enforced by this code. Although the credential file is intended to have owner-only permissions, filesystem permissions do not eliminate risks from malware running as the same user, compromised backups, accidental archival, filesystem disclosure, or defects elsewhere in the host environment. ### Attack Path 1. A user completes the Topview device authorization flow. 2. The OAuth response contains an API key, account metadata, and potentially an access token. 3. `auth.py` writes all these values to `~/.topview/credentials.json`. ...[truncated 1039 chars]
- Remediation
- ## Remediation Suggestions 1. Store only the fields required by `scripts/shared/config.py`: ```python creds = { "uid": data.get("uid", ""), "api_key": api_key, "created_at": datetime.now(timezone.utc).isoformat(), } ``` 2. Do not persist `access_token` unless a documented runtime operation requires it. 3. If access-token persistence becomes necessary, use an operating-system credential vault rather than a plaintext JSON file. 4. Document the token's purpose, scope, expiration, and revocation behavior. 5. Avoid storing profile and billing fields; retrieve them on demand through authenticated API calls. 6. On upgrade, migrate existing credential files by removing unnecessary fields. 7. Ensure logout revokes server-side tokens where the Topview API supports revocation, rather than only deleting the local file.