T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Undisclosed Plaintext Persistence of User-Supplied Content
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Representative command handler: ```bash validate) shift if [ $# -eq 0 ]; then echo "Recent validate entries:" tail -20 "$DATA_DIR/validate.log" 2>/dev/null || echo " No entries yet. Use: swagger-generator validate " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/validate.log" local total=$(wc -l < "$DATA_DIR/validate.log") echo " [Swagger Generator] validate: $input" echo " Saved. Total validate entries: $total" _log "validate" "$input" fi ;; ``` The same storage pattern is repeated by the `check`, `generate`, `format`, `lint`, `explain`, `convert`, `template`, `diff`, `preview`, `fix`, and `report` handlers. ### Technical Analysis The script is designed to store complete command arguments in predictable plaintext files beneath: ```text ~/.local/share/swagger-generator/ ``` API descriptions and OpenAPI-related input can contain internal endpoint names, private server addresses, proprietary schemas, authentication configuration, example API keys, bearer tokens, or customer data. The script neither identifies nor redacts such values before writing them to disk. The documentation does not disclose that command input is retained. No explicit retention period, deletion command, encryption, or restrictive permission initialization is provided. The directory and files therefore inherit the invoking environment's default permission behavior and `umask`. The current top-level handlers also use `local` outside a function, which normally causes Bas ...[truncated 1509 chars]- Remediation
View remediation