T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:51
- Finding
- Passwords and Authentication Codes Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51-65 and 85-96 **Vulnerability Type**: Exposure of credentials through process arguments, shell history, logs, and agent telemetry **Risk Level**: Medium ### Vulnerable Code ```bash # 3. Are you logged in? mega-whoami >/dev/null 2>&1 && echo "LOGGED IN" || echo "NOT LOGGED IN" ``` ```text If the server is not running: `mega-cmd-server &` If not logged in: `mega-login email password` ``` ```bash ### Scriptable Mode (agent uses this → ALWAYS use `mega-`) mega-login email password mega-put ~/file.pdf /Destination/ mega-get /remote/file.pdf ~/Downloads/ ``` ```bash ### Interactive Mode mega-cmd MEGA CMD> login email password MEGA CMD> put ~/file.pdf /Destination/ ``` The same unsafe pattern also appears in: - `README.md`, lines 173-183 - `README.md`, lines 203-209 - `README.pt-BR.md`, lines 173-183 and 203-209 - `SKILL.pt-BR.md`, lines 66 and 85-101 - `references/complete-commands-reference.md`, lines 44-80 - `references/comandos-completos.pt-BR.md`, lines 44-80 ### Technical Analysis The skill repeatedly presents commands that place account passwords and optional MFA authentication codes directly in the command-line argument vector. Depending on the operating system and execution environment, these values may be exposed through: - Shell history files - Process enumeration utilities such as `ps` - Process accounting and endpoint monitoring - CI/CD logs - Terminal transcripts - Agent tool-call telemetry - Automation audit logs - Error reports that record the complete command Although later sections warn that inline passwords are unsafe, the prerequisite workflow directly instructs the agent to use `mega-login email password`. The unsafe command is therefore likely to be copied or executed before the warning is considered. Placeholder values can also be replaced automatically with real user credentials by an agent. The command reference similarly documents password changes, account ...[truncated 1706 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the prerequisite fallback with interactive login that does not include a password: ```bash mega-login user@example.com ``` Instruct the user to enter the password through MEGAcmd's protected prompt. 2. Do not ask users to provide passwords, MFA codes, session IDs, recovery keys, protected-link passwords, or proxy passwords through chat. 3. Clearly separate syntax documentation from safe agent-executable examples. Use placeholders only in a syntax table, accompanied by an explicit statement that agents must not execute the inline-secret form. 4. Move credential-safety instructions before the first login example. The first executable login workflow should be the secure workflow. 5. Where non-interactive authentication is unavoidable, use a documented protected secret mechanism that does not expose values in the argument vector. Avoid inventing environment-variable or standard-input support unless MEGAcmd officially supports it. 6. Before running authentication commands, disable command echoing in automation and confirm that the execution environment does not log secret input. 7. Remove or rewrite examples such as: ```bash mega-login email password ``` and: ```bash mega-passwd new-password ``` 8. Add post-incident guidance: rotate an exposed password, revoke other sessions with `mega-killsession -a`, review public links and sharing, and inspect account activity. ]]>