T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:15
- Finding
- Notion API Key Stored Without Restrictive File Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 15–16 **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_key ``` ### Technical Analysis The setup instructions write a Notion bearer token to a plaintext file without explicitly restricting the permissions of either the configuration directory or the credential file. Their resulting permissions depend on the user's current `umask`. With a commonly used `022` mask, the directory may be created with mode `0755` and the file with mode `0644`, potentially making the API key readable by other local users. Because the file contains a bearer token, possession of the value is sufficient to authenticate as the Notion integration. No executable scripts automatically perform this setup, but users who follow the documented commands can create the insecure condition. ### Attack Path 1. A user follows the setup instructions and stores a valid Notion integration token in `~/.config/notion/api_key`. 2. The user's `umask` permits group or world read access, resulting in an inadequately protected credential file. 3. Another local user or a compromised process operating under another account reads the file. 4. The attacker submits the stolen token in the `Authorization: Bearer` header to `https://api.notion.com`. 5. The attacker reads or modifies Notion resources that were shared with the affected integration. This path requires local filesystem access and permissive resulting file permissions. ### Impact Assessment The attacker obtains the effective privileges of the compromised Notion integration. The accessible scope is limited by the integration's configured capabilities and by the pages or databases shared with it. Depending on those permissions, compromise could permit disclosure, creation, alteration, or deletion of Notion content. This iss ...[truncated 70 chars]
- Remediation
- ## Remediation Suggestions Create the directory and credential file with explicit owner-only permissions, rather than relying on the ambient `umask`: ```bash install -d -m 700 "$HOME/.config/notion" install -m 600 /dev/null "$HOME/.config/notion/api_key" printf '%s\n' 'ntn_your_key_here' > "$HOME/.config/notion/api_key" ``` Alternatively, apply `umask 077` before creating either object: ```bash umask 077 mkdir -p "$HOME/.config/notion" printf '%s\n' 'ntn_your_key_here' > "$HOME/.config/notion/api_key" ``` The instructions should also recommend verifying permissions with `stat`, rotating any token that may have been exposed, granting the integration only the minimum required Notion capabilities, and sharing only necessary pages or databases with it. Users should avoid entering real tokens directly into commands that may be retained in shell history; a non-echoing prompt or suitable operating-system secret manager is preferable.