T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:14
- Finding
- Notion API Token Stored Without Restrictive File Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 14–15 **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium **Vulnerable Code**: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_key ``` ### Technical Analysis The documented setup writes a Notion bearer token to a plaintext file without explicitly restricting the permissions of either the configuration directory or the credential file. The resulting permissions depend on the user's current `umask` and any permissions already assigned to `~/.config/notion`. On a multi-user system with permissive settings, another local account or compromised process may be able to read the token. Because subsequent API examples use this file as an authentication source, possession of its contents is sufficient to impersonate the Notion integration. ### Attack Path 1. A user follows the documented setup and stores a valid Notion API token in `~/.config/notion/api_key`. 2. The user's `umask` or pre-existing directory permissions leave the credential file accessible to another local principal. 3. A local attacker or compromised process reads the token from the file. 4. The attacker supplies the token in an `Authorization: Bearer` header to `https://api.notion.com`. 5. The attacker reads or modifies Notion resources shared with the integration, subject to its configured capabilities. ### Impact Assessment Successful exploitation exposes the privileges granted to the Notion integration. Depending on its capabilities and shared resources, an attacker may search, read, create, or update Notion pages, data sources, properties, and blocks. The scope is limited to content accessible to the integration; this does not inherently grant broader operating-system privileges.
- Remediation
- ## Remediation Suggestions Create the configuration directory and credential file with explicit owner-only permissions: ```bash install -d -m 700 ~/.config/notion umask 077 printf '%s\n' "ntn_your_key_here" > ~/.config/notion/api_key chmod 600 ~/.config/notion/api_key ``` Prefer an operating-system credential store or secrets manager instead of a plaintext file where practical. Grant the integration only the capabilities it requires, share only necessary Notion resources with it, avoid printing the token in logs or shell traces, and rotate the token immediately if unauthorized access is suspected.