T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:5- Finding
Undisclosed Persistent Storage of Potentially Sensitive User Input
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory under the user's home directory whenever it starts. The `add` command writes all supplied content to `data.log`, while `_log` records command names and their first arguments in `history.log`. This storage behavior is not disclosed in `SKILL.md` and is unrelated to the documented press-release generation workflow. Press-release drafts and command arguments can contain confidential product, financing, event, crisis-response, or contact information. Such content is retained in plaintext without an explicit user retention decision, redaction, encryption, restrictive permission setup, or documented cleanup policy. The script relies on the process's existing `umask` and does not explicitly restrict directory and file permissions. The exposure therefore depends on the host's filesystem permissions and configuration. No network transmission or privilege escalation was identified. ### Attack Path 1. A user invokes the packaged `press-release` utility. 2. The script creates the persistent directory defined by `PRESS_RELEASE_DIR`, `XDG_DATA_HOME`, or the default path `$HOME/.local/share/press-release`. 3. The user supplies confidential content through the `add` command or places sensitive information in the first argument to a logged command. 4. The content is appended in plaintext to `data.log` and/or `history.log`. 5. A local pr ...[truncated 914 chars]- Remediation
View remediation