T09 · Insecure Skill Coding Practices
- Location
scripts/finance.py:14- Finding
Sensitive Financial Data Stored Without Enforced Restrictive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/finance.py, lines 14–29 and 40–41
Vulnerability Type: Plaintext sensitive-data storage with insufficient permission enforcement
Risk Level: MediumVulnerable Code
python DATA_DIR = Path.home() / "private_data" / "openclaw" / "workspace" / "data" / "finance" DATA_DIR.mkdir(parents=True, exist_ok=True) PERSONAL_EXPENSES = DATA_DIR / "personal_expenses.json" SHOP_PURCHASES = DATA_DIR / "shop_purchases.json" SHOP_SALES = DATA_DIR / "shop_sales.json" SETTINGS = DATA_DIR / "settings.json" def init_files(): for f in [PERSONAL_EXPENSES, SHOP_PURCHASES, SHOP_SALES]: if not f.exists(): f.write_text("[]") if not SETTINGS.exists(): SETTINGS.write_text(json.dumps({ "monthly_budget": 5000, "operating_costs": 0, "expense_categories": [ "餐饮", "购物", "交通", "住房", "医疗", "通讯", "娱乐", "教育", "其他" ] }, ensure_ascii=False, indent=2)) def save_json(path: Path, data): path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")Technical Analysis
The Skill stores personal spending history, budget settings, shop purchases, sales, inventory-related data, costs, and profits as plaintext JSON files in a predictable location. Directory and file creation do not explicitly enforce owner-only permissions.
Actual permissions therefore depend on the runtime environment's existing permissions and process umask. Under a permissive umask or an inadequately protected parent directory, financial files may be readable by other local users or processes. Subsequent calls to
write_text()do not correct insecure permissions on existing files.The fixed location also makes the records straightforward to discover. This is an insecure coding practice involving sensitive local data, although the code does not itself transmit the records or deliberately grant access to another account.
Attac
...[truncated 1442 chars]
- Remediation
View remediation
Remediation Suggestions
- Create and validate the data directory with owner-only permissions:
python DATA_DIR.mkdir(parents=True, exist_ok=True, mode=0o700) os.chmod(DATA_DIR, 0o700)-
Create new files atomically with mode
0600, rather than relying on the process umask. For example, useos.open()withO_CREAT | O_EXCLand an explicit mode. -
Validate that each destination is a regular file owned by the expected user before reading or writing it. Reject symbolic links and unexpected file types.
-
Correct permissions on existing data files where appropriate:
python for path in (PERSONAL_EXPENSES, SHOP_PURCHASES, SHOP_SALES, SETTINGS): if path.exists(): os.chmod(path, 0o600)-
Use atomic writes through a securely created temporary file in the same protected directory, followed by
os.replace(). Apply mode0600to the temporary file. -
Where the threat model includes privileged local attackers, filesystem backups, or device theft, consider authenticated encryption with keys managed separately from the stored JSON files.
-
Document that the files contain sensitive financial data and should not be placed in shared directories, source control, or unencrypted backups.