T09 · Insecure Skill Coding Practices
Warning
- Location
references/workflows-automation.md:32- Finding
Cloudways Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
"$HEADER_FILE" chmod 600 "$HEADER_FILE" curl --silent --show-error \ --header @"$HEADER_FILE" \ "https://api.cloudways.com/api/v2/server" ``` 3. For the legacy form body, use a protected temporary configuration or input file rather than an expanded `-d` argument. Avoid the legacy flow entirely for new deployments because the project already identifies it as deprecated. 4. Ensure temporary files are: - Created with `mktemp`, not predictable names. - Created under `umask 077`. - Explicitly restricted to mode `600`. - Removed through an `EXIT` trap on success and failure. 5. Do not embed credentials directly in copied commands. Prompt without echo, retrieve them from a secrets manager, or inject them through a controlled job-runner secret facility. 6. Disable or redact command and process telemetry for jobs that must handle credentials, and verify that CI/CD and automation platforms do not record expanded commands. 7. Continue using short-lived, integration-specific tokens with the smallest available role: - READ for monitoring and audits. - LIMITED for narrowly defined write workflows. - FULL ACCESS only when unavoidable. 8. Revoke and rotate any credential that may already have appeared in shell history, process telemetry, logs, screenshots, or shared command transcripts. 9. Update the installation example so it demonstrates the protected mechanism rather than placeholders that users are expected to replace inline. ]]>