T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/twitter_oauth_client.py:337
- Finding
- API Key Disclosed Through Standard Output## Vulnerability Details **File Location**: `scripts/twitter_oauth_client.py:337-366`, `scripts/twitter_oauth_client.py:470-478`, and `scripts/twitter_oauth_client.py:538-551` **Vulnerability Type**: Plaintext secret exposure in application output **Risk Level**: High ### Vulnerable Code ```python if result.get("ok") is False or result.get("code") != 200: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "results": publish_results, } latest_tweet_id = extract_tweet_id(result) if not latest_tweet_id: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "error": "Missing tweet_id in relay response.", "results": publish_results, } return { "ok": True, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "results": publish_results, } ``` ```python output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, ensure_ascii=False)) ``` ```python response = { "ok": True, "relay_base_url": config["base_url"], "aisa_api_key": config["aisa_api_key"], "timeout": config["timeout"], "supported_commands": ["authorize", "post", "status"], "supported_endpoints": ["/twitter/auth_twitter", "/twitter/post_twitter"], "media_upload": { "field_name": "media_files", "transport": "multipart/form-data", "supported_media_types": ["image/*", "video/*"], }, } print(json.dumps(response, indent=2, ensu ...[truncated 1903 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `aisa_api_key` from every authorization, posting, error, and status response. 2. Never print authentication secrets to standard output or standard error. 3. If key identification is operationally necessary, display only a non-sensitive fingerprint or a fixed mask such as `****`. 4. Add a centralized output-sanitization function that recursively removes fields named `aisa_api_key`, `api_key`, `authorization`, `token`, or similar secret-bearing fields. 5. Ensure HTTP error bodies and relay responses are sanitized before printing because an upstream service could reflect credentials. 6. Add regression tests that configure a known test secret, invoke every command and failure path, and assert that the secret does not appear in captured output. 7. Rotate any API key that may already have appeared in transcripts or logs, and remove historical copies where feasible.