T09 · Insecure Skill Coding Practices
Error
- Location
scripts/binance-sync.ts:214- Finding
Exchange credentials are exposed through command-line arguments
- Content
View full analysis
'); result = await fetchBinanceBalances(apiKey, apiSecret); break; } case 'validate': { const apiKey = process.argv[3]; const apiSecret = process.argv[4]; if (!apiKey || !apiSecret) throw new Error('Usage: validate '); result = await validateBinanceCredentials(apiKey, apiSecret); break; } ``` ```ts // scripts/ibkr-sync.ts:289-304 switch (command) { case 'sync': { const token = process.argv[3]; const queryId = process.argv[4]; if (!token || !queryId) throw new Error('Usage: sync '); result = await fetchIbkrPositions(token, queryId); break; } case 'validate': { const token = process.argv[3]; const queryId = process.argv[4]; if (!token || !queryId) throw new Error('Usage: validate '); result = await validateIbkrCredentials(token, queryId); break; } ``` The command instructions explicitly direct the agent to invoke these interfaces with plaintext credentials: ```md Validate via `npx tsx /scripts/binance-sync.ts validate ` Run `npx tsx /scripts/ibkr-sync.ts sync ` ``` ### Technical Analysis Secrets placed in `process.argv` become part of the process command line. Depending on the operating system and execution environment, that command line may be visible through process-inspection interfaces, shell history, te ...[truncated 1775 chars]- Remediation
View remediation