T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Credentials Are Stored Without Enforced Owner-Only Permissions
- Content
View full analysis
bool: """Save credentials to credentials.json file.""" try: with open(CREDS_FILE, "w") as f: json.dump(creds, f, indent=2) return True except IOError as e: print(f"Failed to save credentials: {e}", file=sys.stderr) return False ``` ### Technical Analysis The application writes `credentials.json` using the default permissions determined by the process umask. It does not explicitly enforce owner-only permissions such as `0600`. According to `register.py`, this file contains a Trustra API key. That key is accepted by endpoints that initiate escrow payments, release funds, withdraw funds, cancel escrows, and export the managed wallet's private key. Consequently, it must be treated as a high-value financial credential. Although `.gitignore` excludes `credentials.json` from normal Git operations, that does not protect it from other local users, backup systems, accidental file copying, or processes running under different accounts. On a shared host with a permissive umask, the file may be group-readable or world-readable. ### Attack Path 1. A victim registers an agent, causing `save_credentials()` to create `credentials.json`. 2. The host uses a permissive umask or otherwise exposes the project directory to another local account. 3. An attacker with local filesystem access reads `credentials.json`. 4. The attacker extracts the `api_key`. 5. The attacker authenticates to the Trustra API using the stolen key. 6. Depending on the wallet and escrow state, the attacker invokes financial endpoints or calls `/wallet/export` to retrieve the wallet private key. 7. Retrieval of the private key can result in complete control over assets held by the managed wallet. ### Impact Assessment Succ ...[truncated 453 chars]- Remediation
View remediation