T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:15
- Finding
- MFA Code Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Sensitive authentication data exposed in command-line arguments **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - Headless: `gccli auth login you@example.com --headless` (with `--mfa-code <code>` for MFA) ``` ### Technical Analysis The documented headless authentication workflow instructs users to supply a sensitive MFA code through a command-line argument. Command-line arguments can be exposed through: - Shell history files. - Process inspection tools while the command is executing. - Terminal logging or session recording. - Diagnostic reports and command telemetry. - Accidental copying of complete commands into tickets, chat messages, or documentation. Although MFA codes are short-lived, they remain sensitive authentication material during their validity period. Passing the code as an argument provides weaker confidentiality than a masked interactive prompt, protected standard-input channel, or secure credential broker. The network communication with Garmin is consistent with the Skill's declared functionality. The issue is specifically the local handling of the MFA code, rather than the necessary transmission of authentication information to Garmin. ### Attack Path 1. A user follows the documented headless-login procedure and executes `gccli` with `--mfa-code` followed by a valid code. 2. The complete command is retained in shell history, captured by terminal logging, or temporarily made available through local process inspection. 3. A local user, monitoring process, telemetry collector, or party with access to the history file obtains the MFA code. 4. Before the code expires, the party attempts to use it in a compatible Garmin authentication flow for which the other required authentication conditions are available. 5. If accepted, the party may complete an authentication attempt and obtain access associated with the affected Garmin acc ...[truncated 914 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a masked interactive prompt that reads the MFA code without displaying it or placing it in process arguments. 2. For headless environments, support reading the code from standard input or a protected file descriptor, for example: ```bash read -rsp "MFA code: " MFA_CODE printf '%s\n' "$MFA_CODE" | gccli auth login you@example.com --headless --mfa-code-stdin unset MFA_CODE ``` This example requires corresponding safe standard-input support from `gccli`; such support should be implemented upstream if it does not currently exist. 3. Avoid recommending environment variables as the primary replacement because they can also leak through process environments, diagnostics, or inherited child processes. 4. If command-line submission remains the only supported mechanism: - Clearly warn that the code may enter shell history and appear in process listings. - Recommend temporarily disabling history before the command and restoring it afterward. - Advise users not to run the command in recorded or shared terminal sessions. - Ensure the code is never included in logs or error messages. 5. Update the documentation to present the secure authentication mechanism as the default workflow rather than an optional precaution. ]]>