T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/capabilities/configure/cmd.py:39
- Finding
- Access Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capabilities/configure/cmd.py:39-45` **Additional Locations**: `SKILL.md:266`, `SKILL.md:318`, `references/capabilities/configure.md:11-24` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python ak = sys.argv[1].strip() is_valid, error_msg = validate_ak(ak) if not is_valid: print_output(False, f"❌ {error_msg}", {"configured": False}) return write_ok = configure_via_gateway(ak) or configure_via_file(ak) ``` The documented invocation explicitly places the credential in the command: ```bash python {baseDir}/cli.py configure YOUR_AK_HERE ``` ### Technical Analysis The complete Access Key is accepted as a command-line argument through `sys.argv`. Command-line secrets can be exposed through: - Shell history files. - Process listings such as `ps` while the command is running. - Terminal recordings and session transcripts. - Agent tool-call logs or command audit logs. - Process-monitoring and endpoint-management software. - Error reports that capture command invocations. The command masks the key in its eventual output, but masking occurs only after the complete credential has already passed through these exposure surfaces. The credential is security-sensitive because `_auth.py` splits it into an Access Key ID and Access Key secret used to generate authenticated HMAC signatures. ### Attack Path 1. A merchant follows the documented command and supplies the complete Access Key as an argument. 2. The shell, agent runtime, operating system, or monitoring infrastructure records the command line. 3. A local user, process, administrator, or log reader obtains the recorded argument. 4. The exposed value is split into its Access Key ID and secret using the same format implemented by `_auth.py`. 5. The attacker uses the recovered credential to sign requests to the 1688 Skill gateway. ### Impact Assessment Successful ...[truncated 517 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace command-line credential input with masked interactive input: ```python from getpass import getpass api_key = getpass("Enter the Access Key: ").strip() ``` 2. For noninteractive use, accept the credential through standard input or a dedicated secret-provider interface rather than a process argument. 3. Remove documentation examples that place credentials directly in command text. 4. Ensure agent-generated tool calls never include credentials in visible execution logs or conversational output. 5. Avoid exposing credentials through environment variables when the runtime makes process environments broadly observable. 6. Add tests verifying that configuration commands do not place the Access Key in `sys.argv`, output, exceptions, or logs. ]]>