T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/gmail-auth.sh:56
- Finding
- OAuth Refresh Token Can Remain in a Temporary File## Vulnerability Details **File Location**: `scripts/gmail-auth.sh`, lines 56-75 **Vulnerability Type**: Incomplete cleanup of plaintext OAuth credentials **Risk Level**: Medium ### Vulnerable Code ```bash # Create token file for gog import token_file=$(mktemp) cat > "$token_file" << EOF { "email": "${email}", "client": "default", "refresh_token": "${refresh_token}", "scopes": ["${SCOPE}"] } EOF echo -e "${GREEN}Token exchange successful!${NC}" echo "" echo "Importing to gog..." if [[ -z "$GOG_KEYRING_PASSWORD" ]]; then echo -e "${YELLOW}Note: Set GOG_KEYRING_PASSWORD environment variable for non-interactive import${NC}" fi gog auth tokens import "$token_file" rm "$token_file" ``` ### Technical Analysis The script writes a Gmail OAuth refresh token in plaintext to a temporary file. Although `mktemp` normally creates a uniquely named file with restrictive permissions, cleanup occurs only after `gog auth tokens import` succeeds. The script enables `set -e`, so a nonzero exit from `gog`, an interruption, termination signal, system failure, or shell crash can end execution before `rm "$token_file"` is reached. The resulting file may remain in the temporary directory until an external cleanup process removes it. A Gmail refresh token is a long-lived credential. The configured `gmail.modify` scope permits broad mailbox access, including reading messages, sending mail, and modifying mailbox state. Consequently, residual plaintext storage is security-sensitive even if access is initially limited to the account that created the file. ### Attack Path 1. A user successfully completes the Google OAuth authorization flow. 2. The script exchanges the authorization code and receives a refresh token. 3. The refresh token is written to the file created by `mktemp`. 4. `gog auth tokens import` fails, the process is interrupted, or the host terminates before the explicit `rm` comma ...[truncated 1067 chars]
- Remediation
- ## Remediation Suggestions Register cleanup immediately after creating the file so it occurs on normal exit, errors, and common termination signals: ```bash token_file=$(mktemp) chmod 600 "$token_file" cleanup() { rm -f -- "$token_file" } trap cleanup EXIT HUP INT TERM ``` Additional hardening measures: 1. Set `umask 077` near the beginning of the script before creating any credential-bearing files. 2. If supported by `gog`, import the token through standard input or a protected file descriptor rather than writing it to disk. 3. Validate that the temporary file is a regular file owned by the current user before writing to it. 4. Keep the cleanup trap active until import completes, then remove the file explicitly and clear the trap. 5. Avoid including temporary credential files in backups, crash reports, or diagnostic collections. 6. Consider overwriting the file before removal where the underlying storage environment makes that meaningful, while recognizing that secure overwriting is unreliable on journaling or copy-on-write filesystems.