T09 · Insecure Skill Coding Practices
Error
- Location
scripts/twitter_oauth_client.py:337- Finding
API Key Disclosed Through Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/twitter_oauth_client.py:337-366,scripts/twitter_oauth_client.py:470-478, andscripts/twitter_oauth_client.py:538-551
Vulnerability Type: Plaintext secret exposure in application output
Risk Level: HighVulnerable Code
python if result.get("ok") is False or result.get("code") != 200: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "results": publish_results, } latest_tweet_id = extract_tweet_id(result) if not latest_tweet_id: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "error": "Missing tweet_id in relay response.", "results": publish_results, } return { "ok": True, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "results": publish_results, }python output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, ensure_ascii=False))python response = { "ok": True, "relay_base_url": config["base_url"], "aisa_api_key": config["aisa_api_key"], "timeout": config["timeout"], "supported_commands": ["authorize", "post", "status"], "supported_endpoints": ["/twitter/auth_twitter", "/twitter/post_twitter"], "media_upload": { "field_name": "media_files", "transport": "multipart/form-data", "supported_media_types": ["image/*", "video/*"], }, } print(json.dumps(response, indent=2, ensu ...[truncated 1903 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
aisa_api_keyfrom every authorization, posting, error, and status response. - Never print authentication secrets to standard output or standard error.
- If key identification is operationally necessary, display only a non-sensitive fingerprint or a fixed mask such as
****. - Add a centralized output-sanitization function that recursively removes fields named
aisa_api_key,api_key,authorization,token, or similar secret-bearing fields. - Ensure HTTP error bodies and relay responses are sanitized before printing because an upstream service could reflect credentials.
- Add regression tests that configure a known test secret, invoke every command and failure path, and assert that the secret does not appear in captured output.
- Rotate any API key that may already have appeared in transcripts or logs, and remove historical copies where feasible.
- Remove