T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:33
- Finding
- API Key May Be Stored with Insecure File Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 33-36 **Vulnerability Type**: Insecure credential storage permissions **Risk Level**: Medium **Complete Code Snippet**: ```bash Store your key securely: ```bash mkdir -p ~/.config/wavestreamer echo '{"api_key": "sk_..."}' > ~/.config/wavestreamer/credentials.json ``` ``` ### Technical Analysis The documented credential-storage procedure creates a directory and writes an API key without explicitly applying restrictive permissions. The resulting access permissions depend on the user's current `umask`. With a common `022` umask, `credentials.json` may be created with mode `0644`, making the API key readable by other local users. Although persistent credential storage supports the Skill's authenticated functionality, access by users other than the credential owner is unnecessary and violates least-privilege principles. Shell redirection also overwrites any existing credential file without warning. No evidence was found that the Skill intentionally transmits this locally stored credential to an unrelated service. The issue is the unsafe storage guidance itself. ### Attack Path 1. A user follows the Quick Start instructions and inserts a valid API key into the command. 2. The shell creates `~/.config/wavestreamer/credentials.json` using permissions derived from the current `umask`. 3. If the resulting file is readable by other local accounts, an attacker with local filesystem access reads the API key. 4. The attacker supplies the stolen value through the documented `X-API-Key` header. 5. The attacker impersonates the affected waveStreamer Agent and invokes authenticated API operations. This path requires local access through another account or a process that can read the affected user's permissively protected files. ### Impact Assessment A stolen API key can permit impersonation within the waveStreamer service. Based on the documented endpoints, an ...[truncated 442 chars]
- Remediation
- ## Remediation Suggestions - Create the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.config/wavestreamer" ``` - Create the credential file atomically with mode `0600`. For example: ```bash umask 077 tmp="$(mktemp "$HOME/.config/wavestreamer/credentials.json.XXXXXX")" printf '%s\n' '{"api_key":"sk_..."}' > "$tmp" mv -f -- "$tmp" "$HOME/.config/wavestreamer/credentials.json" ``` - Instruct existing users to harden previously created files: ```bash chmod 700 "$HOME/.config/wavestreamer" chmod 600 "$HOME/.config/wavestreamer/credentials.json" ``` - Prefer an operating-system secret store or protected runtime environment injection rather than a plaintext JSON file. - Warn users not to commit, upload, log, or share the credential file. - Avoid placing real secrets directly in shell command history; use an interactive prompt or secret-manager integration. - Document API-key rotation and immediate revocation procedures for suspected exposure.