T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/login.py:68
- Finding
- Access Token and One-Time Verification Code Exposed Through Process Arguments and Console Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/login.py`, lines 68-70 and 91-99 **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```python parser.add_argument("--contact", required=True, help="Phone number or email") parser.add_argument("--code", help="Verification code (for login)") parser.add_argument("--invitation-code", help="Invitation code (optional)") ``` ```python print(f"\nAccess Token:") print(result.get("authorization")) print(f"\nUser Info:") print(f" User ID: {result.get('userId')}") print(f" Nickname: {result.get('nickname')}") print(f" Email: {result.get('email')}") print(f" Mobile: {result.get('mobile')}") print("\n📝 Add to your environment:") print(f'export NEODOMAIN_ACCESS_TOKEN="{result.get("authorization")}"') ``` The same command-line token pattern appears throughout the API scripts, including: ```python parser.add_argument("--token", "--access-token", dest="token", help="Access token") ``` The documentation explicitly demonstrates expanding the access token into command-line arguments, for example: ```bash python3 {baseDir}/scripts/image_models.py --token $NEODOMAIN_ACCESS_TOKEN ``` ### Technical Analysis The login workflow accepts the one-time verification code through `--code`, while generation scripts accept the long-lived access token through `--token`. Command-line arguments can be exposed through process inspection facilities, shell history, terminal recording, CI logs, debugging tools, and process-monitoring software. After login, the script writes the complete access token to standard output twice, including as a ready-to-copy shell command. It also prints account attributes such as email address and mobile number. This increases the chance that credentials and personal information will be retained in agent transcripts, execution logs, terminal scrollback, or automation logs. Sending the contact and verification code to the declared Neodomain HTTPS authent ...[truncated 1511 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Read verification codes interactively with `getpass.getpass()` rather than accepting them through command-line arguments. - Remove `--token` from normal usage and obtain the token exclusively from a protected credential store or environment variable. - If noninteractive credential input is required, support a file descriptor or a token file restricted to the current user rather than a command-line value. - Do not print the complete token, shell export command, email address, or mobile number by default. - Return only a success message and masked token identifier. Provide an explicit, security-warned option for revealing a token when unavoidable. - Ensure agent and CI runners redact `NEODOMAIN_ACCESS_TOKEN`, verification codes, authorization responses, and personal account fields from logs. - Recommend a dedicated short-lived, scope-limited API token rather than a general session token. - Revoke and rotate any token that may already have been retained in logs or transcripts. ]]>