T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:21- Finding
Grafana Service-Account Token Exposed Through Shell Command Arguments
- Content
View full analysis
/api/azure-mcp","transport":"streamable-http","headers":{"Authorization":"Bearer "}}' ``` ``` ### Technical Analysis The setup instructions direct the user to replace `` with a valid Grafana service-account token and place that secret directly in a command-line argument. Secrets supplied this way may be exposed through: - Interactive shell history files. - Process inspection while the command is running. - Terminal session recording and command auditing. - Diagnostic bundles, support logs, or telemetry that capture command lines. - Accidental copying of the command into tickets, chat messages, or documentation. Although the file contains only a placeholder and does not ship a hardcoded credential, following the documented procedure with a real token creates a plaintext credential-handling weakness. ### Attack Path 1. A user follows the documented one-time setup procedure and replaces `` with a live Grafana service-account token. 2. The shell records the complete command in its history, or the command becomes visible through process or audit inspection. 3. An attacker with access to the same local account, readable history files, process metadata, terminal recordings, or collected diagnostic data extracts the bearer token. 4. The attacker submits the token to the configured Azure Managed Grafana endpoint. 5. The attacker obtains the permissions assigned to that service account and may access the AMG MCP interface and associated Azure monitoring data until the token expires or is revoked. ### Impact Assessment Successful exploitation grants the attacker the effective ...[truncated 558 chars]- Remediation
View remediation