T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:267- Finding
Bearer Token Stored in Plaintext Without Enforced File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 267–271
Vulnerability Type: Plaintext credential storage with unsafe default permissions
Risk Level: MediumComplete Code Snippet:
bash ## After Registration Save credentials: ```bash mkdir -p ~/.brouter echo '{"token":"...","agentId":"..."}' > ~/.brouter/credentials.jsontext ### Technical Analysis The documented command stores a bearer token and agent identifier in an unencrypted file. It does not explicitly restrict the permissions of either `~/.brouter` or `credentials.json`; their effective permissions depend on the user's current `umask`. The token is documented as valid for 90 days and authorizes financially consequential Brouter API operations. Persisting it is relevant to the Skill's functionality, but storing it without enforced owner-only access does not follow least-privilege credential-handling practices. This issue is locally exploitable if another user, process, backup service, or compromised application can read the credential file. Exploitation requires local read access or an equivalent disclosure path; the audited file does not establish remote access to the credential. ### Attack Path 1. A user follows the documented registration and credential-saving procedure. 2. The shell creates `~/.brouter/credentials.json` using permissions derived from the user's `umask`. 3. A local attacker or compromised process with sufficient filesystem access reads the file. 4. The attacker extracts the bearer token and agent ID. 5. The attacker submits authenticated requests to Brouter while impersonating the agent. 6. Subject to the account's balance and server-side authorization controls, the attacker performs operations such as staking, transferring sats, voting with funds, posting jobs, or settling jobs. ### Impact Assessment Successful exploitation can compromise the Brouter agent account for the remaining lifetime of th ...[truncated 439 chars]- Remediation
View remediation
Remediation Suggestions
- Create the credential directory with explicit owner-only permissions:
bash install -d -m 700 "$HOME/.brouter" - Create the credential file atomically with mode
600, independent of the user's existingumask:bash umask 077 printf '%s\n' '{"token":"...","agentId":"..."}' > "$HOME/.brouter/credentials.json" chmod 600 "$HOME/.brouter/credentials.json" - Prefer an operating-system credential manager or secret store instead of a plaintext JSON file.
- Avoid placing real token values directly in shell command history. Accept them through a protected input channel or parse the registration response directly into a permission-restricted file.
- Document token rotation, revocation, expiry, and incident-response procedures.
- Validate file ownership and permissions before reading stored credentials, and refuse overly permissive files.
- Ensure logs, backups, diagnostics, and error messages do not capture the token.
- Create the credential directory with explicit owner-only permissions: