T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:48- Finding
Kanboard credentials may be exposed through insecure transport and process arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–56; related configuration at lines 535–540
Vulnerability Type: Credential exposure through unrestricted transport and command-line arguments
Risk Level: HighVulnerable Code
bash kb() { local method="$1" local params="${2:-{}}" local user="${KANBOARD_USER:-jsonrpc}" local pass="${KANBOARD_PASS:-$KANBOARD_API_TOKEN}" curl -s -X POST \ -u "$user:$pass" \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"$method\",\"id\":1,\"params\":$params}" \ "${KANBOARD_URL}/jsonrpc.php" | jq . }The documented configuration permits an arbitrary URL without enforcing HTTPS:
bash # Required export KANBOARD_URL="https://kanboard.example.com" export KANBOARD_API_TOKEN="your_token_from_settings_page" # Optional (for User API / "My…" procedures) export KANBOARD_USER="your_username" export KANBOARD_PASS="your_password_or_personal_token"Technical Analysis
The helper sends Kanboard credentials using HTTP Basic authentication through
curl -u. Two credential-exposure conditions are present:- Transport security is not enforced.
KANBOARD_URLis accepted without checking its scheme or destination. If it is set to anhttp://URL, Basic authentication credentials can be observed in plaintext by a network-positioned attacker. If configuration is manipulated to reference an attacker-controlled HTTPS origin, the credentials are delivered directly to that origin. - Credentials are supplied as a command-line argument. The expression
-u "$user:$pass"can place the username and password or API token in thecurlprocess argument list. Depending on operating-system process visibility, container configuration, monitoring, and audit tooling, another local user or service may capture the secret while the request is running.
The default credential is particularly sensi ...[truncated 2271 chars]
- Transport security is not enforced.
- Remediation
View remediation
Remediation Suggestions
-
Enforce HTTPS before every request.
- Parse and validate
KANBOARD_URL. - Reject URLs whose scheme is not exactly
https. - Do not silently downgrade to HTTP.
- Continue using normal TLS certificate and hostname verification.
- Parse and validate
-
Restrict the destination.
- Configure an explicit trusted Kanboard origin instead of accepting arbitrary runtime destinations where practical.
- Reject embedded credentials, unexpected ports, redirects to different origins, and malformed URLs.
- Consider
curl --proto '=https' --proto-redir '=https'and disable cross-origin credential forwarding.
-
Keep credentials out of command-line arguments.
- Use a permission-restricted curl configuration file, protected credential helper, or equivalent secret-injection mechanism that does not expose the secret in process arguments.
- If a temporary credential file is unavoidable, create it with mode
0600, use a secure temporary-file API, and remove it immediately with reliable cleanup traps. - Ensure secrets are not emitted in shell tracing, debug output, logs, or error messages.
-
Apply least privilege.
- Prefer a dedicated User API account limited to the required projects and operations.
- Avoid the unrestricted Application API token unless the workflow specifically requires it.
- Separate read-only and administrative automation credentials.
-
Harden request behavior.
- Add
--fail-with-body,--show-error, and suitable connection and request timeouts. - Define an explicit redirect policy and do not forward authentication to an untrusted redirected host.
- Validate configuration before executing any API operation.
- Add
-
Rotate potentially exposed credentials.
- Revoke and regenerate credentials if the helper has been used with HTTP, an untrusted destination, permissive process visibility, or command-line collection tooling.
- Review K ...[truncated 75 chars]
-