T09 · Insecure Skill Coding Practices
Warning
- Location
bin/cli.js:41- Finding
Feishu App Secret Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
', '飞书应用ID（覆盖环境变量）') .option('--app-secret ', '飞书应用密钥（覆盖环境变量）') .action(async (options) => { try { if (options.appId) process.env.FEISHU_APP_ID = options.appId; if (options.appSecret) process.env.FEISHU_APP_SECRET = options.appSecret; ``` The same `--app-secret` option is repeated across the CLI commands. ### Technical Analysis The CLI permits a Feishu App Secret to be supplied directly as a command-line argument. Command-line arguments are not an appropriate secret transport because they can be exposed through: - Shell history files. - Process inspection utilities and process-monitoring services. - Agent execution logs, audit records, or terminal session recordings. - CI/CD job output and command tracing. - Diagnostic or crash-reporting systems that retain command invocations. Copying the argument into `process.env` does not remove it from the original process argument vector or any previously recorded shell history. The environment-variable configuration already supported by the project is safer than accepting secrets through a visible argument, although environment variables must also be protected from logging and unauthorized process access. ### Attack Path 1. A user or Agent invokes the Skill with a command such as: ```bash node bin/cli.js get --document-id dcnxxxxxx \ --app-id cli_xxxxxx \ --app-secret actual-secret-value ``` 2. The complete command is retained in shell history, Agent tool logs, CI logs, telemetry, or local process metadata. 3. An attacker with access to one of those records obtains the App ID and App Secret. 4. The attacker submits the stolen credentials to Feishu's tenant access-token endpoint. 5. Feishu returns a tenant access token if the cr ...[truncated 977 chars]- Remediation
View remediation