T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Undisclosed Persistent Storage of User-Supplied Command Input
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` A representative command handler demonstrating the repeated storage behavior is located at lines 143-159: ```bash palette) shift if [ $# -eq 0 ]; then echo "Recent palette entries:" tail -20 "$DATA_DIR/palette.log" 2>/dev/null || echo " No entries yet. Use: fontpick palette " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/palette.log" local total=$(wc -l < "$DATA_DIR/palette.log") echo " [Fontpick] palette: $input" echo " Saved. Total palette entries: $total" _log "palette" "$input" fi ;; ``` Equivalent plaintext input-storage behavior is repeated for the `preview`, `generate`, `convert`, `harmonize`, `contrast`, `export`, `random`, `browse`, `mix`, `gradient`, and `swatch` handlers. ### Technical Analysis The script creates `~/.local/share/fontpick` and persistently stores complete command arguments in plaintext. For an argument-taking command, the input is intended to be written both to a command-specific log and to `history.log`. The storage is not disclosed in `SKILL.md`, which presents the project as a font-pairing and typography helper. The script does not establish a restrictive `umask`, explicitly set file permissions, redact potentially sensitive values, enforce retention limits, or request user consent before logging. Consequently, the permissions applied to the directory and log files depend on the invoking environment's default umask. In a common environment using umask `022`, the ...[truncated 2111 chars]- Remediation
View remediation