T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:16
- Finding
- Plaintext Secret Disclosure Through Standard Output## Vulnerability Details **File Location**: `references/cli-examples.md`, lines 16 and 20 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```bash op run --no-masking -- printenv DB_PASSWORD ``` ```bash echo "db_password: {{ op://app-prod/db/password }}" | op inject ``` ### Technical Analysis The first command explicitly disables 1Password's output masking and passes a database password to `printenv`, causing the resolved secret to be written to standard output. The second command sends an injected configuration containing the resolved database password to standard output. In an agent, CI, gateway, or terminal-automation environment, standard output may be retained in execution logs, terminal captures, chat transcripts, or monitoring systems. These examples therefore conflict with the guardrail in `SKILL.md` that says secrets must never be pasted into logs, chat, or code. ### Attack Path 1. A user or automated agent follows one of the documented examples. 2. The authenticated `op` process retrieves the referenced database password. 3. `--no-masking` causes `printenv` to display the real value, or `op inject` emits the resolved configuration. 4. The execution platform records standard output. 5. A person or service with access to the retained output obtains the plaintext credential. 6. The exposed credential can then be used against every database or service for which it remains valid. ### Impact Assessment The exposure does not itself grant additional local operating-system privileges. It can grant the application or database privileges associated with the disclosed credential, potentially including unauthorized data access, modification, or deletion. The scope depends on the credential's permissions, reuse, validity period, and the readership of captured output.
- Remediation
- ## Remediation Suggestions - Remove the `--no-masking -- printenv DB_PASSWORD` example. - Do not demonstrate successful secret injection by printing the resolved value. - Use `op run` to pass secrets directly to the intended process while retaining masking. - If an example must verify injection, have the child process report only whether the variable is populated, never its value. - Add an explicit warning that agent output, CI logs, terminal captures, and chat transcripts must be treated as disclosure channels. - Rotate any credential that has already been exposed through captured output.