T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:5- Finding
Undisclosed Plaintext Persistence of User-Supplied Arguments
- Content
View full analysis
[args] Commands: run Execute main function config Configuration status Show status init Initialize list List items add Add entry remove Remove entry search Search export Export data info Show info help Show this help version Show version Data: \$DATA_DIR EOF } _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory on every invocation and writes command arguments to plaintext files: - `_log` appends the first supplied argument to `history.log`. - `cmd_add` ap ...[truncated 2430 chars]- Remediation
View remediation