T09 · Insecure Skill Coding Practices
Error
- Location
src/config.ts:65- Finding
Wallet Private Key and Pinata JWT Are Persisted Insecurely
- Content
View full analysis
", "Set private key") .option("-o, --operator ", "Set operator address") .option("-a, --arbiter-url ", "Set arbiter server URL") .option("-c, --court-url ", "Set court UI URL (for independent verification)") .option("-n, --network ", "Set network ID (e.g., eip155:84532)") .option("-r, --rpc ", "Set RPC URL") .option("--pinata-jwt ", "Set Pinata JWT token") ``` `src/config.ts:65-79` merges those credentials into the configuration and writes them to disk as plaintext without explicitly restricting permissions: ```ts export function saveConfigFile(config: CliConfigFile): void { if (!fs.existsSync(CONFIG_DIR)) { fs.mkdirSync(CONFIG_DIR, { recursive: true }); } // Merge with existing config const existing = loadConfigFile(); const merged = { ...existing, ...config }; // Remove undefined/null values for (const key of Object.keys(merged)) { if (merged[key as keyof CliConfigFile] === undefined || merged[key as keyof CliConfigFile] === null) { delete merged[key as keyof CliConfigFile]; } } fs.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2)); } ``` The documented setup command also encourages passing the private key on the command line: ```bash npx --yes @x402r/cli config --key --arbiter-url https://www.moltarbiter.com/arbiter ``` ### Technical Analysis The configuration model includes both `privateKey` and `pinataJwt`. T ...[truncated 2560 chars]- Remediation
View remediation