T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:135- Finding
Plaintext Storage of API Keys and Other Sensitive Configuration Data
- Content
View full analysis
` | Log a configuration note such as model parameters, API keys, or environment settings. Use this to record setup changes and track which configurations were active during experiments. | ``` The data directory and history log are created without explicitly restrictive permissions: ```bash DATA_DIR="${HOME}/.local/share/genai-toolkit" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` Configuration input is then written to both the category log and unified history log: ```bash else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/configure.log" local total=$(wc -l < "$DATA_DIR/configure.log") echo " [Genai Toolkit] configure: $input" echo " Saved. Total configure entries: $total" _log "configure" "$input" fi ``` ### Technical Analysis The documented workflow encourages users to submit API keys or environment configuration to the `configure` command. The script stores that input verbatim in `configure.log` and duplicates it in `history.log`. Neither the data directory nor the generated files receive explicit modes such as `0700` and `0600`. Their effective permissions therefore depend on the invoking user's umask and the surrounding environment. A permissive umask can make the files readable by other local users. Export functionality may also produce additional plaintext copies of these records. No credential detection, redaction, encryption, retention control, or warning is implemented. This viola ...[truncated 1226 chars]- Remediation
View remediation