T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dinzee.py:260- Finding
Gateway call records are stored with world-readable and world-writable permissions
- Content
View full analysis
Path: root = data_dir() provider_dir = root / _safe_path_component(provider) target = provider_dir / _safe_path_component(tool) for directory in (root, provider_dir, target): directory.mkdir(parents=True, exist_ok=True) directory.chmod(DATA_DIR_MODE) probe = target / f".dinzee-write-test-{uuid.uuid4().hex}.tmp" try: with probe.open("x", encoding="utf-8") as f: f.write("") probe.chmod(stat.S_IRUSR | stat.S_IWUSR) finally: if probe.exists(): probe.unlink() return target ``` ```python def _save_call_record(target_dir: Path, payload: dict, body: dict) -> Path: now = _utc_now() target_dir.mkdir(parents=True, exist_ok=True) target_dir.chmod(DATA_DIR_MODE) target = target_dir / _call_record_filename(payload, body) record = { "schema_version": 1, "saved_at": now.isoformat().replace("+00:00", "Z"), "gateway": { "base_url": base_url(), "call_id": body.get("call_id"), "idempotency_key": payload.get("idempotencyKey"), "authority_correlation_id": body.get("authority_correlation_id"), }, "request": { "provider": payload.get("provider"), "tool": payload.get("tool"), "arguments": payload.get("arguments") or {}, }, "response": body, } tmp = target.with_name(f".{target.name}.{uuid.uuid4().hex}.tmp") try: with tmp.open("x", encoding="utf-8") as f: json.dump(record, f, ensure_ascii=False, indent=2) f.write("\n") tmp.chmod(DATA_FILE_MODE) tmp.replace(target) ...[truncated 2419 chars]- Remediation
View remediation