T09 · Insecure Skill Coding Practices
- Location
SKILL.md:22- Finding
Unrestricted Secret Retrieval Combined with Persistent Output Logging
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-26
Vulnerability Type: Unconstrained secret access and potential plaintext secret retention
Risk Level: HighComplete Code Snippet:
text ## Workflow 1. Receive a script or command request. 2. Use `bws secret get` to fetch necessary environment variables. 3. Execute the command. 4. If a prompt appears, wait for Paul to type `/approve`. 5. Log the output to `memory/YYYY-MM-DD.md`.Technical Analysis
The workflow instructs the agent to retrieve secrets for a received script or command request, but it does not restrict which Bitwarden secrets may be requested or define a per-script secret allowlist. It also does not require separate authorization for each secret, constrain how retrieved values are supplied to subprocesses, or prevent commands from printing those values.
The subsequent requirement to log command output to
memory/YYYY-MM-DD.mdcreates a sensitive-data retention hazard. A command that prints its environment, arguments, configuration, error context, or retrieved secret can cause that value to be stored in plaintext persistent memory. The general execution-approval requirement does not fully mitigate this issue because the specification does not state that approvals disclose or constrain the requested secret set, nor does it require output redaction.This behavior exceeds minimum privilege for the declared automation function: each approved script should receive only explicitly authorized secret values needed for that specific operation, while logs should exclude those values.
The audited file does not establish that secrets are sent to an untrusted network destination.
bws secret getmay communicate with Bitwarden as part of its legitimate retrieval function, but direct network exfiltration is not confirmed by the available content.Attack Path
- An attacker or untrusted user submits a plausible script or command ...[truncated 1346 chars]
- Remediation
View remediation
Remediation Suggestions
- Define an explicit allowlist mapping each approved script to the exact secret identifiers it may use.
- Require separate, informed authorization for every secret retrieval, displaying the script identity and secret identifier without displaying the value.
- Configure the Bitwarden runtime identity with least-privilege access to only the secrets required for supported automation tasks.
- Reject free-form commands that request secrets; permit secret injection only for reviewed scripts with fixed interfaces.
- Supply secrets through a narrowly scoped mechanism, such as protected standard input or a dedicated file descriptor, rather than command-line arguments or a broadly inherited environment.
- Ensure child processes cannot unintentionally propagate secrets to unrelated subprocesses.
- Redact retrieved secret values and known encodings from standard output, standard error, exception messages, and diagnostic logs before persistence.
- Replace unconditional raw-output logging with structured, allowlisted audit events containing command identity, approval status, exit status, and timestamps only.
- Apply restrictive permissions, retention limits, and secure deletion procedures to memory logs.
- Abort execution and logging if output redaction cannot be guaranteed, and test controls against environment dumps, shell tracing, crash reports, and verbose error modes.