T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:53
- Finding
- SMTP Credential Exposure Through Agent-Generated Command Text## Vulnerability Details **File Location**: `SKILL.md`, lines 53–63 and line 73 **Vulnerability Type**: Sensitive credential exposure through command construction **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash SMTP_HOST=smtp.163.com \ SMTP_PORT=465 \ SMTP_SECURE=true \ SMTP_USER=your-email@example.com \ SMTP_PASS=your-smtp-password \ SMTP_FROM="Your Name <your-email@example.com>" \ node {baseDir}/scripts/send.js \ --to "recipient@example.com" \ --subject "Email Subject" \ --body "Email Body" ``` ```text When the user requests sending an email, use the exec tool to execute the command above. ``` ### Technical Analysis The Skill directs the AI Agent to execute a shell command containing the SMTP password as an inline environment-variable assignment. When the placeholder is replaced with a real credential, the secret becomes part of the generated command text. Although an inline assignment may not be retained in ordinary interactive shell history in every execution environment, the complete command can still be exposed through Agent conversation records, tool-call transcripts, executor logs, audit telemetry, debugging output, or process inspection. This behavior also conflicts with the Skill's own warning against placing real SMTP credentials directly on the command line. The executable script itself reads `SMTP_PASS` from the environment and does not print it. The vulnerability is therefore in the documented Agent invocation procedure rather than in `scripts/send.js`. ### Attack Path 1. A user or operator configures the Skill with a real SMTP account and password. 2. The Agent follows `SKILL.md` and constructs an `exec` command containing `SMTP_PASS=<real-secret>`. 3. The Agent platform, execution service, telemetry system, or another monitoring component records the complete tool call or command. 4. An attacker with access to those records extracts the SMTP username, host, a ...[truncated 740 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `SMTP_PASS` and other credentials from all generated command strings and examples intended for direct Agent execution. 2. Provision SMTP credentials through the executor's inherited environment, a platform secret manager, or a dedicated credential-injection mechanism. 3. Instruct the Agent to invoke only the script and non-secret arguments, for example: ```bash node {baseDir}/scripts/send.js \ --to "recipient@example.com" \ --subject "Email Subject" \ --body "Email Body" ``` 4. Configure the Agent platform and execution layer to redact known secret values and sensitive environment-variable names from tool-call records, logs, traces, and error reports. 5. Use a dedicated SMTP authorization token with the minimum necessary permissions instead of the mailbox's primary password. 6. Rotate any credential that may already have appeared in Agent transcripts or executor logs. 7. Restrict access to historical tool logs and define a short retention period for records that may contain sensitive command data.