T09 · Insecure Skill Coding Practices
Warning
- Location
- references/06b_accounts1_user1000.txt:56
- Finding
- Host-Specific Account Metadata Exposed in Bundled D-Bus Snapshots<![CDATA[ ## Vulnerability Details **File Locations**: - `references/06b_accounts1_user1000.txt:56-81` - `references/06_accounts1.txt:47` - `references/21_daemon_accounts.txt:47` - `scripts/introspect.sh:4,12-15` **Vulnerability Type**: Plaintext disclosure of host-specific account metadata **Risk Level**: Medium ### Vulnerable Code The packaged account snapshot contains a real local username, home directory, stable account UUID, shell, locale, and privileged group memberships: ```text readonly as Groups = ['lp', 'lpadmin', 'netdev', 'sambashare', 'scanner', 'sudo', 'users', 'zane']; readonly s UUID = 'c022d476-2d8c-4dc6-9f7b-7b2b06c4db68'; readonly s Shell = '/bin/bash'; readonly s IconFile = 'file:///var/lib/AccountsService/icons/illustration/pumpkin_carriage.png'; readonly s Locale = 'zh_CN.UTF-8'; readonly s HomeDir = '/home/zane'; readonly s UserName = 'zane'; ``` Additional reference snapshots expose the same username through the system group list: ```text readonly as GroupList = ['_ssh', 'adm', 'audio', 'avahi', 'backup', 'bin', 'bluetooth', 'cdrom', 'crontab', 'daemon', 'dde', 'deepin-admin-daemon', 'deepin-daemon', 'deepin-linglong', 'dialout', 'dip', 'disk', 'fax', 'floppy', 'games', 'geoclue', 'input', 'irc', 'kmem', 'kvm', 'lightdm', 'list', 'lp', 'lpadmin', 'mail', 'man', 'messagebus', 'netdev', 'news', 'nm-openconnect', 'nm-openvpn', 'nogroup', 'operator', 'pipewire', 'plugdev', 'polkitd', 'proxy', 'pulse', 'pulse-access', 'render', 'root', 'sambashare', 'sasl', 'scanner', 'seat', 'sgx', 'shadow', 'src', 'ssl-cert', 'sstpc', 'staff', 'sudo', 'sys', 'systemd-coredump', 'systemd-journal', 'systemd-network', 'systemd-timesync', 'tape', 'tss', 'tty', 'users', 'utmp', 'uucp', 'video', 'voice', 'winbindd_priv', 'www-data', 'zane']; ``` The snapshot-generation script writes complete introspection output into a hardcoded, user-specific directory: ```bash OUTPUT_DIR="/home/zane/.openclaw/workspace/skills/deepin-desktop/references" SAFE=$(echo "$DEST ...[truncated 3134 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all live, host-specific introspection snapshots from the distributable package. 2. Regenerate reference files as schema-only documentation that contains method, signal, property, and type definitions without current property values. 3. Redact at least the following before retaining generated output: - Usernames and full names - Home-directory paths - UUIDs and other stable identifiers - Group memberships - Login timestamps and history - Password hints and authentication state - Network addresses, device identifiers, and repository configuration 4. Replace the hardcoded output directory with an explicit caller-provided directory or a path resolved relative to the script: ```bash OUTPUT_DIR="${3:?Usage: $0 <service-name> <object-path> <output-directory>}" mkdir -p -- "$OUTPUT_DIR" chmod 700 -- "$OUTPUT_DIR" ``` 5. Write generated snapshots outside the published Skill tree by default. 6. Add generated introspection output to version-control and packaging ignore rules. 7. Apply restrictive permissions to temporary and generated files, such as `umask 077`. 8. Introduce an automated pre-release scan that rejects usernames, home paths, UUIDs, credentials, tokens, account memberships, and live D-Bus property values. 9. Use synthetic example values in documentation, such as `example-user`, `/home/example-user`, and a clearly non-production UUID. ]]>