T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:8
- Finding
- Secret Disclosure Through Unmasked CLI Output and tmux Pane Capture## Vulnerability Details **File Location**: `references/cli-examples.md:8-19`; `SKILL.md:29-47` **Vulnerability Type**: Sensitive information exposure through terminal output and session capture **Risk Level**: High ### Vulnerable Code `references/cli-examples.md:8-19`: ```bash ## Read - `op read op://app-prod/db/password` - `op read "op://app-prod/db/one-time password?attribute=otp"` - `op read "op://app-prod/ssh key/private key?ssh-format=openssh"` - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ``` `SKILL.md:29-47`: ```bash ## REQUIRED tmux session (T-Max) The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name. Example (see `tmux` skill for socket conventions, do not reuse old session names): ```bash SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/clawdbot-tmux-sockets}" mkdir -p "$SOCKET_DIR" SOCKET="$SOCKET_DIR/clawdbot-op.sock" SESSION="op-auth-$(date +%Y%m%d-%H%M%S)" tmux -S "$SOCKET" new -d -s "$SESSION" -n shell tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 tmux -S "$SOCKET" kill-session -t "$SESSION" ``` ``` ### Technical Analysis The documented `op read` commands emit sensitive values directly to standard output, including passwords, one-time passwords, and SSH private keys. The `op run --no-masking -- printenv DB_PASSWORD` example explicitly disables 1Password's output masking and then prints the resolved password. The main workflow ...[truncated 2584 chars]
- Remediation
- ## Remediation Suggestions 1. Remove examples that print secrets directly, particularly: - `op read` without a protected destination or consumer - `op run --no-masking` - `printenv` or similar commands used to display resolved credentials 2. Preserve 1Password's output masking and prohibit `--no-masking` in agent-driven workflows. 3. Prefer passing secrets directly to their intended process with `op run` without printing the corresponding environment variables. 4. Do not invoke `tmux capture-pane` after any command that may emit a secret. Separate authentication and non-sensitive verification from secret-consuming operations. 5. If pane capture is necessary for diagnostics, capture only known non-sensitive commands and apply strict redaction before returning output to an agent, chat, or log. 6. Disable or tightly limit tmux history for secret-bearing sessions, and destroy the session immediately after use. 7. When a secret must be written to disk: - Set a restrictive `umask`, such as `077`, before file creation. - Use an explicitly protected destination outside the repository. - Verify permissions are limited to the current user. - Exclude generated files from version control and backups where appropriate. - Securely remove temporary material as soon as the consuming operation finishes. 8. Add an explicit workflow rule stating that agents must never return resolved secret values in tool output or conversation text. 9. Add automated checks or policy enforcement to reject commands containing dangerous combinations such as `--no-masking`, `printenv` of secret variables, or pane capture following `op read`. 10. Rotate any credential that may already have appeared in captured pane output, agent transcripts, or execution logs.