T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:7- Finding
Financial History and Configuration Files May Be Created with Overly Permissive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 7–18
Vulnerability Type: Insecure filesystem permissions
Risk Level: Mediumbash DATA_DIR="$HOME/.compound" DATA_FILE="$DATA_DIR/data.jsonl" CONFIG_FILE="$DATA_DIR/config.json" VERSION="1.0.0" mkdir -p "$DATA_DIR" touch "$DATA_FILE" if [ ! -f "$CONFIG_FILE" ]; then cat > "$CONFIG_FILE" << 'EOF' {"default_frequency": "monthly", "currency_symbol": "$", "decimal_places": 2} EOFTechnical Analysis
The script creates
~/.compound,data.jsonl, andconfig.jsonwithout setting a restrictiveumaskor explicitly applying secure permission modes. Their resulting permissions therefore depend on the invoking process's existing umask.Under a common umask of
022, the directory can be created with mode0755, while the history and configuration files can be created with mode0644. If the user's home directory is traversable by other local users, those users may read the files.The history file stores financial information such as principal amounts, interest rates, savings targets, contribution amounts, projected balances, and calculation timestamps. Although this does not provide code execution or elevated privileges, it may expose private financial planning information.
Attack Path
- A user runs the Skill on a multi-user system with a permissive umask, such as
022. - The script creates
~/.compound/data.jsonland~/.compound/config.jsonwithout restrictive modes. - Calculation commands append financial records to
data.jsonl. - A different local user who can traverse the victim's home directory locates
~/.compound/. - The local user reads the world-readable or group-readable history and configuration files.
- The exposed records reveal the victim's financial inputs, goals, contributions, and projected results.
Exploitation requires local access and sufficient directory traversal permissions. T ...[truncated 661 chars]
- A user runs the Skill on a multi-user system with a permissive umask, such as
- Remediation
View remediation
Remediation Suggestions
Set a restrictive umask before creating any persistent data, and explicitly enforce secure modes for both newly created and existing paths:
bash DATA_DIR="$HOME/.compound" DATA_FILE="$DATA_DIR/data.jsonl" CONFIG_FILE="$DATA_DIR/config.json" umask 077 mkdir -p "$DATA_DIR" chmod 700 "$DATA_DIR" touch "$DATA_FILE" chmod 600 "$DATA_FILE" if [ ! -f "$CONFIG_FILE" ]; then cat > "$CONFIG_FILE" << 'EOF' {"default_frequency": "monthly", "currency_symbol": "$", "decimal_places": 2} EOF fi chmod 600 "$CONFIG_FILE"Additional hardening should include:
- Validate that
DATA_DIRis owned by the current user and is not a symbolic link before writing. - Apply secure permissions to existing installations, not only newly created files.
- Replace configuration files atomically using a securely created temporary file in the same protected directory.
- Avoid following attacker-controlled symbolic links when opening persistent files where the platform permits safe open flags.
- Document that calculation history contains potentially private financial data and is stored locally.
- Validate that