T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:5
- Finding
- Persistent Plaintext Logging of Unsanitized Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 5-7, 31, and 34-77 **Vulnerability Type**: Plaintext sensitive-data exposure and log injection **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${APICHECK_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/apicheck}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` ```bash cmd_init() { echo " Project initialized in $(pwd)" _log "init" "${1:-}" } cmd_check() { echo " Running lint + type check + tests..." _log "check" "${1:-}" } cmd_build() { echo " Building..." _log "build" "${1:-}" } cmd_test() { echo " Running test suite..." _log "test" "${1:-}" } cmd_deploy() { echo " Deploy: build -> test -> stage -> prod" _log "deploy" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: checking project health..." _log "status" "${1:-}" } cmd_template() { echo " Template for: $1" _log "template" "${1:-}" } cmd_docs() { echo " Generating docs..." _log "docs" "${1:-}" } cmd_clean() { echo " Cleaned build artifacts" _log "clean" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory and writes the first argument supplied to each operational command directly to `history.log`. The argument is not redacted, validated, length-limited, or escaped before it is stored. If a caller supplies an API token, password, internal URL containing credentials, customer data, or another secret as the first command argument, that value will be retained in plaintext. The script does not set a restrictive `umask` or explicitly assign `0700` permissions to the directory and `0600` permissions to the log. Effective access therefore depends on the invoking environment's existing umask and filesystem controls. The direct use of `echo` ...[truncated 2065 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove command-argument logging if it is not essential to the documented Skill functionality. 2. If logging is required, record only an explicit allowlist of non-sensitive metadata, such as the command name and result status. Do not log arbitrary user-provided arguments. 3. Redact known secret formats and fields, including authorization headers, bearer tokens, passwords, API keys, cookies, and credential-bearing URLs. 4. Reject or escape control characters before logging. Use a structured format and safe serialization rather than concatenating untrusted text into a line-oriented log. 5. Create local state with restrictive permissions: ```bash umask 077 mkdir -p -m 700 "$DATA_DIR" touch "$DATA_DIR/history.log" chmod 600 "$DATA_DIR/history.log" ``` 6. Add retention limits and provide a documented mechanism for inspecting and deleting stored history. 7. Disclose all persistent state creation and logging behavior in `SKILL.md`. 8. Add tests verifying that secrets are not retained and that embedded newlines or other control characters cannot forge log records. ]]>