T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aitubiao-cli.sh:64- Finding
Persistent Arbitrary Command Execution Through Unsafe Credential File Sourcing
- Content
View full analysis
&2 echo "Please configure credentials first. See SKILL.md for setup instructions." >&2 exit 1 fi source "$CREDENTIALS_FILE" if [[ -z "${API_KEY:-}" ]]; then echo "Error: API_KEY is empty in $CREDENTIALS_FILE" >&2 echo "Please add your API Key. Get one at: https://app.aitubiao.com/setting/api-keys?utm_source=skill_skill-clawhub&channel=skill-clawhub" >&2 exit 1 fi if [[ ! "${API_KEY}" =~ ^sk_v1_ ]]; then echo "Error: API_KEY format invalid (must start with sk_v1_)" >&2 echo "Your current key may have expired. Create a new one at: https://app.aitubiao.com/setting/api-keys?utm_source=skill_skill-clawhub&channel=skill-clawhub" >&2 exit 1 fi export BASE_URL="${BASE_URL:-https://api.aitubiao.com}" export CHANNEL="${CHANNEL:-skill-clawhub}" if [[ "$BASE_URL" != "https://api.aitubiao.com" ]]; then echo "Error: BASE_URL in $CREDENTIALS_FILE does not match this CLI's expected endpoint" >&2 echo " Expected: https://api.aitubiao.com" >&2 echo " Current: $BASE_URL" >&2 printf ' Re-run: bash %q auth \n' "$0" >&2 exit 1 fi if [[ -z "$CHANNEL" ]]; then echo "Error: CHANNEL is empty in $CREDENTIALS_FILE" >&2 exit 1 fi } ``` The authentication command accepts any value beginning with `sk_v1_` and writes it directly into that executable file: ```bash cmd_auth() { local api_key="${1:-}" if [[ -z "$api_key" ]]; then echo "Error: API Key required. Usage: aitubiao-cli.sh auth " >&2 echo "Get one at: https:// ...[truncated 3684 chars]- Remediation
View remediation
&2 exit 4 fi ``` The exact length limits should be based on the provider’s actual key specification. 3. **Reject control characters explicitly.** Newlines, carriage returns, null bytes, and other control characters must never be accepted in credential values. 4. **Avoid command-line secret transport.** Read the key from protected standard input or an interactive hidden prompt rather than `auth `, reducing exposure through shell history and process inspection. 5. **Create the credentials directory with restrictive permissions:** ```bash install -d -m 700 "$HOME/.aitubiao" ``` 6. **Write credentials atomically and safely.** Create a temporary file in the destination directory with mode `0600`, write validated data, and atomically rename it into place. Refuse unsafe symbolic-link targets. 7. **Preserve fixed configuration in code.** Since the CLI requires exactly `https://api.aitubiao.com`, keep the base URL as a constant rather than loading it from a credential file. Do the same for the distribution channel unless user ...[truncated 275 chars]