T09 · Insecure Skill Coding Practices
Error
- Location
tool_exec.py:358- Finding
Plaintext Disclosure of OAuth Access and Refresh Tokens
- Content
View full analysis
None: """ Fetch the connected account and display OAuth access and refresh tokens. """ client = get_scalekit_client() print(f" Connection: {connection_name}") print(f" Identifier: {identifier}") print() try: response = client.actions.get_connected_account( connection_name=connection_name, identifier=identifier, ) connected_account = response.connected_account print(f" Connected Account ID: {connected_account.id}") print(f" Status: {connected_account.status}") print() tokens = connected_account.authorization_details["oauth_token"] access_token = tokens["access_token"] refresh_token = tokens["refresh_token"] print(f"{GREEN}✅ Tokens retrieved:{RESET}") print(f" Access Token: {access_token}") print(f" Refresh Token: {refresh_token}") except KeyError as e: print(f"{RED}❌ Error: Could not find token key {e}. authorization_details: {connected_account.authorization_details}{RESET}") _exit(1) except Exception as e: print(f"\n{RED}❌ Error: {e}{RESET}") _exit(1) ``` The operation is exposed through the command-line interface at `tool_exec.py:578-580` and dispatched at `tool_exec.py:777-791`. ### Technical Analysis The `--get-authorization` operation retrieves reusable OAuth credentials from a connected account and prints both the access token and refresh token directly to standard output. Standard output from a Skill can be captured in Agent context, terminal history, orchestration logs, observability systems, or conversation transcripts. Refresh tokens are particularly sensitive because they can permit long-lived ac ...[truncated 1795 chars]- Remediation
View remediation