T09 · Insecure Skill Coding Practices
Error
- Location
kuvera-cli.js:288- Finding
Kuvera Password Exposed Through Command-Line Arguments
- Content
View full analysis
"); process.exit(1); } await login(args[0], args[1]); break; ``` The insecure invocation pattern is also documented in: - `README.md:24` - `SKILL.md:111` - `references/api-guide.md:27` ### Technical Analysis The login command requires the user's Kuvera email address and password to be supplied as positional command-line arguments. Command-line arguments are not a secure secret-input mechanism. Depending on the operating system and execution environment, the password may become visible through: - Shell history files. - Process listings and process-inspection interfaces while the command is running. - OpenClaw, terminal, audit, or command-execution logs. - Diagnostic reports that capture process command lines. - Monitoring or observability tools that record executed commands. The credential is legitimately transmitted over HTTPS to the fixed Kuvera authentication endpoint, but accepting it through `process.argv` exposes it locally before transmission. This exceeds the minimum exposure necessary for authentication because the password can instead be collected through a hidden interactive prompt or protected standard input. ### Attack Path 1. A user follows the documented workflow and runs: ```bash kuvera-cli login victim@example.com KuveraPassword ``` 2. The command, including the plaintext password, is recorded in shell history, execution logs, or another command-recording facility. Alternatively, a local process with sufficient process-inspection access reads the arguments while the CLI is running. 3. An attacker who can access one of these sources extracts the email address and password. 4. The attacker authenticates directly ...[truncated 755 chars]- Remediation
View remediation
` positional-argument examples from `README.md`, `SKILL.md`, `references/api-guide.md`, help output, and error messages. 7. Review OpenClaw command logging and redact authentication inputs from execution records. 8. Encourage users who previously invoked the documented command to remove exposed history entries and rotate their Kuvera passwords where logs or history may have been accessible. ]]>