T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/diagnose.sh:110
- Finding
- Incomplete Credential Redaction in Diagnostic Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/diagnose.sh:110-124` **Vulnerability Type**: Insufficient secret redaction and sensitive configuration disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # Show config (non-sensitive fields only) config_output=$(actual config show 2>&1) || config_output="(could not read config)" while IFS= read -r line; do # Skip lines that look like they contain API key values case "$line" in *api_key*:*sk-*|*api_key*:*key-*) # Redact actual key values but show the field exists field=$(echo "$line" | cut -d: -f1) info "$field: [REDACTED]" ;; *) [ -n "$line" ] && info "$line" ;; esac done <<< "$config_output" ``` ### Technical Analysis The diagnostic script captures the complete output of `actual config show` and prints every line that does not match two narrow shell patterns: ```bash *api_key*:*sk-* *api_key*:*key-* ``` Redaction therefore depends both on a lowercase `api_key` field name and on the value having an anticipated prefix. Credentials with other formats—including Cursor API keys, custom provider keys, bearer tokens, uppercase or differently named fields, and credentials without `sk-` or `key-` prefixes—fall through to the default branch and are printed unchanged. This conflicts with the script's assertion that it “Never prints secrets.” The problem is especially relevant because the Skill explicitly recommends this script for comprehensive diagnostics. Its output may consequently be captured by an AI agent, terminal recording, CI system, support transcript, or shared issue report. The vulnerability does not independently grant system privileges. Exploitation requires a sensitive value to appear in the output of `actual config show` using a format not recognized by the redaction patterns. ### Attack Path 1. A user stores an API key or another credential in the Actual configuration. 2. The credential does not contain an anticipated `sk ...[truncated 1184 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace value-prefix detection with redaction based on normalized sensitive field names. At minimum, redact fields containing terms such as: - `api_key` - `apikey` - `token` - `secret` - `password` - `credential` - `authorization` 2. Prefer an allowlist approach: print only configuration fields explicitly known to be non-sensitive, rather than printing all unmatched output. 3. Add a machine-readable, guaranteed-redacted command to the Actual CLI, such as: ```bash actual config show --redacted --format json ``` The diagnostic script should consume only that output. 4. Treat standard error as potentially sensitive. Do not combine unrestricted standard error with configuration output unless it is also sanitized. 5. Add tests covering: - Cursor keys without recognizable prefixes - Arbitrary bearer tokens - Uppercase and mixed-case field names - Quoted YAML values - Values containing spaces or colons - Multiline YAML values - Unknown future credential fields 6. Until robust redaction is available, report only whether known credential fields are configured, never their values. ]]>