T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-examples.md:8- Finding
Secret Disclosure Through Unmasked CLI Output and tmux Pane Capture
- Content
View full analysis
Vulnerability Details
File Location:
references/cli-examples.md:8-19;SKILL.md:29-47
Vulnerability Type: Sensitive information exposure through terminal output and session capture
Risk Level: HighVulnerable Code
references/cli-examples.md:8-19:bash ## Read - `op read op://app-prod/db/password` - `op read "op://app-prod/db/one-time password?attribute=otp"` - `op read "op://app-prod/ssh key/private key?ssh-format=openssh"` - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD`SKILL.md:29-47:bash ## REQUIRED tmux session (T-Max) The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name. Example (see `tmux` skill for socket conventions, do not reuse old session names): ```bash SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/clawdbot-tmux-sockets}" mkdir -p "$SOCKET_DIR" SOCKET="$SOCKET_DIR/clawdbot-op.sock" SESSION="op-auth-$(date +%Y%m%d-%H%M%S)" tmux -S "$SOCKET" new -d -s "$SESSION" -n shell tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 tmux -S "$SOCKET" kill-session -t "$SESSION"text ### Technical Analysis The documented `op read` commands emit sensitive values directly to standard output, including passwords, one-time passwords, and SSH private keys. The `op run --no-masking -- printenv DB_PASSWORD` example explicitly disables 1Password's output masking and then prints the resolved password. The main workflow ...[truncated 2584 chars]- Remediation
View remediation
Remediation Suggestions
- Remove examples that print secrets directly, particularly:
op readwithout a protected destination or consumerop run --no-maskingprintenvor similar commands used to display resolved credentials
- Preserve 1Password's output masking and prohibit
--no-maskingin agent-driven workflows. - Prefer passing secrets directly to their intended process with
op runwithout printing the corresponding environment variables. - Do not invoke
tmux capture-paneafter any command that may emit a secret. Separate authentication and non-sensitive verification from secret-consuming operations. - If pane capture is necessary for diagnostics, capture only known non-sensitive commands and apply strict redaction before returning output to an agent, chat, or log.
- Disable or tightly limit tmux history for secret-bearing sessions, and destroy the session immediately after use.
- When a secret must be written to disk:
- Set a restrictive
umask, such as077, before file creation. - Use an explicitly protected destination outside the repository.
- Verify permissions are limited to the current user.
- Exclude generated files from version control and backups where appropriate.
- Securely remove temporary material as soon as the consuming operation finishes.
- Set a restrictive
- Add an explicit workflow rule stating that agents must never return resolved secret values in tool output or conversation text.
- Add automated checks or policy enforcement to reject commands containing dangerous combinations such as
--no-masking,printenvof secret variables, or pane capture followingop read. - Rotate any credential that may already have appeared in captured pane output, agent transcripts, or execution logs.
- Remove examples that print secrets directly, particularly: