T09 · Insecure Skill Coding Practices
Error
- Location
scripts/persist_auth.js:28- Finding
<![CDATA[Bearer Token Exposed Through Process Command-Line Arguments]]>
- Content
View full analysis
a.startsWith(`--${name}=`)); if (inline) return inline.slice(name.length + 3); const idx = process.argv.findIndex((a) => a === `--${name}`); if (idx >= 0) return process.argv[idx + 1] || ""; return ""; } function hasFlag(name) { return process.argv.includes(`--${name}`); } function main() { if (hasFlag("clear")) { const { cleared } = clearCredentials(); emit("auth_cleared", { cleared }); return; } const token = String(readArg("token") || "").trim(); const username = String(readArg("username") || "").trim(); if (!token) { emit("error", { message: "缺少 --token 参数（或使用 --clear 清除凭证）" }); process.exitCode = 1; return; } const exp = decodeJwtExp(token); const { username: persistedUsername } = persistCredentials({ token, exp, username }); emit("auth_persisted", { exp, username: persistedUsername || username }); } ``` The prescribed invocation is: ```bash node {baseDir}/scripts/persist_auth.js --token='' --username='' ``` ### Technical Analysis The authentication bearer token is supplied as a command-line argument and read from `process.argv`. Command-line arguments are not an appropriate secret transport. Depending on the operating system, runner, and logging configuration, they may be exposed through: - Process inspection interfaces such as `/proc//cmdline`. - Process-monitoring utilities available to the same user or other authorized local users. - Agent execution logs, debug traces, shell audit systems, or command histories. - Crash reports and observability systems that record complete command lines. The documentation correc ...[truncated 1242 chars]- Remediation
View remediation