T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ads.js:12
- Finding
- Long-Lived Amazon Credentials Stored in an Unprotected Plaintext File## Vulnerability Details **File Location**: `scripts/ads.js:12-16`; related setup instructions in `SKILL.md:15-24` and `README.md:22-31` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```js const CREDS_PATH = process.env.AMAZON_ADS_PATH || './amazon-ads-api.json'; const ENDPOINTS = { na: 'advertising-api.amazon.com', eu: 'advertising-api-eu.amazon.com', fe: 'advertising-api-fe.amazon.com' }; function getCreds() { return JSON.parse(fs.readFileSync(CREDS_PATH, 'utf8')); } ``` The documented credential file contains the following long-lived secrets: ```json { "lwaClientId": "amzn1.application-oa2-client.YOUR_CLIENT_ID", "lwaClientSecret": "YOUR_CLIENT_SECRET", "refreshToken": "Atzr|YOUR_REFRESH_TOKEN", "profileId": "YOUR_ADS_PROFILE_ID", "region": "eu" } ``` ### Technical Analysis The Skill requires users to save an Amazon Login with Amazon client secret and refresh token in a plaintext JSON file. By default, that file is expected in the current project directory as `./amazon-ads-api.json`. Neither the implementation nor the documentation enforces or recommends restrictive file permissions, storage outside the repository, use of a secret manager, or exclusion from version control. The project also does not include a `.gitignore` rule protecting the documented filename. A refresh token is a long-lived credential that can be exchanged for access tokens. Consequently, exposure of this file is materially more serious than exposure of a short-lived access token. The code does not itself transmit these credentials to an unauthorized party: it sends them to Amazon's official HTTPS OAuth endpoint, which is necessary for the declared functionality. The weakness is the local storage and handling model. ### Attack Path 1. A user follows the setup instructions and creates `amazon-ads-api.json` in the project or working directory. 2. The file inhe ...[truncated 1346 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an operating-system credential store, managed secret service, or protected environment variables over a project-local JSON file. 2. If file-based credentials must remain supported: - Require the file to be outside the repository by default. - Reject files whose permissions allow group or world access on supported platforms. - Recommend and enforce mode `0600` where practical. - Resolve the path explicitly and reject unexpected file types such as symbolic links if the execution environment is not trusted. 3. Add `amazon-ads-api.json` and common credential filename variants to `.gitignore`. 4. Update `README.md` and `SKILL.md` with explicit warnings against committing, logging, sharing, or backing up the credential file insecurely. 5. Document credential revocation and rotation procedures. 6. Configure the Amazon application and refresh token with only the minimum API permissions required to list profiles and campaigns. 7. Avoid including token endpoint response bodies in errors where they might contain sensitive diagnostic data; return a sanitized error code and message instead.