T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_composio_mcp.sh:40- Finding
Consumer Key Exposed Through Visible Terminal Input and Process Arguments
- Content
View full analysis
&2; exit 1; } fi ``` The key is subsequently supplied to Python as a command-line argument: ```bash python3 - "$path" "$jsonpath" "$url_field" "$format" "$KEY" "$REMOVE" <<'PY' import json, sys path, jsonpath, url_field, fmt, key, remove = sys.argv[1:7] ``` ### Technical Analysis The interactive prompt uses `read -r` without silent mode, causing the complete consumer key to be displayed as the user types it. This can expose the credential through shoulder surfing, terminal recording, screen sharing, or retained terminal-session logs. The script also passes the complete key to the Python subprocess through `argv`. During the lifetime of that subprocess, the value may be available to local process-inspection mechanisms such as `ps` or `/proc//cmdline`, subject to the operating system's process visibility restrictions. This behavior conflicts with the Skill's documented instruction not to log or expose `ak_*` or `ck_*` credentials. ### Attack Path 1. A user runs `setup_composio_mcp.sh` without setting `COMPOSIO_CONSUMER_KEY`. 2. The script prompts for the consumer key using visible terminal input. 3. A local observer, terminal recorder, screen-sharing participant, or monitoring tool captures the key. 4. Alternatively, a local process capable of inspecting the Python subprocess command line reads the key from its argument list. 5. The captured key is used to authenticate to `https://connect.composio.dev/mcp`. 6. The attacker obtains access to the Composio MCP capabilities and connected application accounts authorized for that consumer key. ### Impact Assessment Disclosure o ...[truncated 493 chars]- Remediation
View remediation