T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/setup_composio_mcp.sh:36
- Finding
- Consumer Key Exposed Through Visible Input and Child Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_composio_mcp.sh:36-39` and `scripts/setup_composio_mcp.sh:91` **Vulnerability Type**: Local credential disclosure **Risk Level**: Medium ### Vulnerable Code ```bash if [ "$REMOVE" -eq 0 ] && [ -z "$KEY" ]; then printf 'Enter your Composio consumer key (ck_...): ' read -r KEY [ -n "$KEY" ] || { echo "No key provided. Aborting." >&2; exit 1; } fi ``` The key is subsequently passed to Python as a command-line argument: ```bash python3 - "$path" "$jsonpath" "$url_field" "$format" "$KEY" "$REMOVE" <<'PY' ``` ### Technical Analysis The interactive prompt uses `read -r` without silent mode, so the consumer key is displayed while the user types it. The key is then placed in the argument vector of a child Python process. On systems where process arguments are visible to other local users, monitoring agents, audit systems, or diagnostic tooling, the complete reusable `ck_*` credential may be captured. Passing a secret through an argument vector is less secure than transmitting it through a protected file descriptor or standard input. The behavior is not necessary for the Skill's declared functionality. Configuration can be generated without exposing the secret through visible terminal input or child-process arguments. ### Attack Path 1. A user runs the setup helper and enters a Composio consumer key. 2. An observer captures the visible terminal input, terminal recording, or Python process argument vector. 3. The observer extracts the `ck_*` value. 4. The observer sends authenticated requests to `https://connect.composio.dev/mcp`. 5. The observer gains access to MCP capabilities available to that consumer key and any linked accounts. ### Impact Assessment Successful exploitation discloses a reusable Composio consumer credential. The resulting scope depends on the Composio project, connected toolkits, and linked accounts. It may permit reading external account data or invoking actions suc ...[truncated 80 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Read interactive secrets without terminal echo: ```bash printf 'Enter your Composio consumer key (ck_...): ' IFS= read -rs KEY printf '\n' ``` 2. Do not place the key in the Python argument vector. Pass it through standard input or a dedicated inherited file descriptor. 3. Avoid exporting the key into a broadly inherited environment when a narrower channel is available. 4. Clear the shell variable after configuration: ```bash unset KEY ``` 5. Prefer writing a supported environment-variable reference into MCP configurations instead of copying the literal key. 6. Document that users should use an OS secret manager or a permission-restricted environment file. ]]>