T09 · Insecure Skill Coding Practices
Error
- Location
scripts/capabilities/get_bindlist/cmd.py:25- Finding
Access-Key Material Is Exposed Through Binding-List CLI Output
- Content
View full analysis
dict: """获取当前用户的多店铺绑定关系及 AK Returns: API 响应 data 字段，包含 bindList 数组 每个元素包含：companyName, isOwner, ak """ data = api_post("/api/alibaba.1688.newton.shop.list.binds/1.0.0", {}) if not isinstance(data, dict): raise ServiceError("格式异常，请稍后重试") return data ``` ```python # scripts/capabilities/get_bindlist/cmd.py try: result = get_bindlist() print_output(True, "多店铺绑定关系查询成功", { "data": result, }) except Exception as e: print_error(e, {"data": {}}) ``` ### Technical Analysis The binding-list service documentation explicitly states that each returned entry can contain an `ak` field. The service returns the gateway response without applying a field-level allowlist, and the command serializes that complete response into standard output. As a result, access-key material returned by the gateway can enter: - Agent or model context - Workflow execution traces - Terminal output and shell logs - Diagnostic captures - Copied or forwarded command output Encoding a credential with Base64 would not mitigate this issue because Base64 is reversible and provides no confidentiality. The command only needs shop identifiers and display metadata for report generation; returning per-shop access-key material exceeds the minimum data exposure required by the declared functionality. ### Attack Path 1. An authenticated user or workflow invokes `python3 cli.py get_bindlist`. 2. The service sends an authenticated request to the binding-list API. 3. The gateway returns binding entries that may include `companyName`, `isOwner`, and `ak`. 4. `get_bindlist()` returns the response without r ...[truncated 866 chars]- Remediation
View remediation