T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:15
- Finding
- Notion API Key Stored in a Plaintext File Without Enforced Access Restrictions## Vulnerability Details **File Location**: `SKILL.md`, lines 15-17 **Vulnerability Type**: Plaintext credential storage with permissions determined by the user's environment **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_key ``` The credential is subsequently loaded at line 23: ```bash NOTION_KEY=$(cat ~/.config/notion/api_key) ``` ### Technical Analysis The setup instructions store a long-lived Notion bearer token in a plaintext file but do not explicitly restrict permissions on either `~/.config/notion` or `~/.config/notion/api_key`. The resulting access permissions depend on the user's current `umask` and any preexisting directory permissions. In an environment with permissive defaults, another local user or compromised process operating under a different account may be able to read the token. Because the token is used directly as a bearer credential, possession of it is sufficient to authenticate to the Notion API; no additional proof of identity is required. ### Attack Path 1. A user follows the documented setup and writes a valid Notion integration token to `~/.config/notion/api_key`. 2. The file or its parent directory receives permissions derived from a permissive `umask` or retains insecure preexisting permissions. 3. Another local principal, or a compromised process with filesystem access, reads the plaintext credential. 4. The attacker submits requests to `https://api.notion.com` with the stolen token in the `Authorization: Bearer` header. 5. The attacker reads or modifies Notion resources available to that integration until the credential is revoked or rotated. ### Impact Assessment Successful exploitation exposes the privileges assigned to the Notion integration. Depending on which pages and databases have been shared with it, an attacker may be able to search, read, create, or modify pages, blocks, and data-source ...[truncated 224 chars]
- Remediation
- ## Remediation Suggestions Enforce owner-only permissions when creating both the configuration directory and credential file: ```bash install -d -m 700 ~/.config/notion umask 077 printf '%s\n' "ntn_your_key_here" > ~/.config/notion/api_key chmod 600 ~/.config/notion/api_key ``` Additionally: - Prefer an operating-system credential manager or dedicated secret store instead of a plaintext file. - Verify that an existing `~/.config/notion` directory is owned by the expected user and is not writable by other principals. - Grant the Notion integration only the API capabilities and workspace resources required for its intended tasks. - Document procedures for revoking and rotating the token if local credential exposure is suspected. - Avoid printing the token in terminal output, logs, shell tracing, or command history.