T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:4
- Finding
- Undisclosed Persistent Logging of User-Supplied Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 4–7 and 32–80 **Vulnerability Type**: Plaintext sensitive-data retention and unsafe file handling **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${BROWSER_DEVTOOLS_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/browser-devtools}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } cmd_info() { echo " Version: $VERSION | Data: $DATA_DIR" _log "info" "${1:-}" } ``` ### Technical Analysis The script persistently records the first argument supplied to most commands in `history.log`. The `add` command additionally records all supplied arguments in `data.log`. These writes occur without warning the user, filtering potentially sensitive values, defining a retention policy, or explicitly applying restrictive file permissions. This behavior conflicts with the documented expectation that results are sent to standard output. Users may therefore supply file paths, search terms, identifiers, tokens, or other sensitive strings without realizing that those values will remain on disk. The destination can be changed through `BROWSER_DEVTOOLS_DIR` ...[truncated 1821 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove persistent command logging unless it is essential to the tool's documented purpose. 2. Do not record raw user arguments. If operational logging is necessary, record only the command name or explicitly redact tokens, credentials, personal data, paths, and search terms. 3. Clearly document every persistent file, the information it contains, and its retention behavior. 4. Require explicit user consent before enabling argument logging, and keep it disabled by default. 5. Set restrictive permissions before creating storage: ```bash umask 077 mkdir -p -- "$DATA_DIR" ``` 6. Validate that the data directory is owned by the current user and is not a symbolic link. 7. Before appending, reject symbolic links and non-regular files for `history.log` and `data.log`. Use a safer file-opening mechanism that prevents symbolic-link traversal where available. 8. Validate or constrain `BROWSER_DEVTOOLS_DIR` and `XDG_DATA_HOME`; reject unsafe, unexpected, or shared locations. 9. Provide commands to inspect, disable, and securely delete retained history. 10. Update `SKILL.md` to accurately disclose local persistence rather than stating only that results go to standard output. ]]>