T09 · Insecure Skill Coding Practices
Warning
- Location
--parent-node <APP_TOKEN> \ --app-id <APP_ID> --app-secret <APP_SECRET> ``` ### Technical Analysis The script accepts the Feishu App Secret through the `--app-secret` command-line argument. Secrets supplied this way can be recorded in interactive shell history and exposed in process metadata while the script is running. Depending on operating-system process isolation and monitoring configuration, local users, process-monitoring agents, diagnostic collectors, or CI logging systems may be able to retrieve ...[truncated 1644 chars]:64- Finding
Feishu App Secret Exposed Through Command-Line Arguments
- Content
View full analysis
--parent-node \ --app-id --app-secret ``` ### Technical Analysis The script accepts the Feishu App Secret through the `--app-secret` command-line argument. Secrets supplied this way can be recorded in interactive shell history and exposed in process metadata while the script is running. Depending on operating-system process isolation and monitoring configuration, local users, process-monitoring agents, diagnostic collectors, or CI logging systems may be able to retrieve the argument. Although environment-variable input is also supported, the insecure argument mode is explicitly implemented and presented as a standard usage method. The script therefore encourages users to expose a long-lived application credential through channels not designed for secret storage. ### Attack Path 1. A user follows the documented argument-mode example and invokes the script with `--app-secret `. 2. The command is retained in shell history, CI command logs, terminal auditing records, or process telemetry. While the process is active, the argument may also be available through process inspection where local access controls permit it. 3. An attacker or unauthorized operator with access to one of those records retrieves the App ID and App Secret. 4. The attacker submits the stolen credentials to the Feishu tenant-token endpoint. 5. If the credentials remain valid ...[truncated 620 chars]- Remediation
View remediation