T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
MFA Code Exposed Through Command-Line Arguments
- Content
View full analysis
` for MFA) ``` ### Technical Analysis The documented headless authentication workflow instructs users to supply a sensitive MFA code through a command-line argument. Command-line arguments can be exposed through: - Shell history files. - Process inspection tools while the command is executing. - Terminal logging or session recording. - Diagnostic reports and command telemetry. - Accidental copying of complete commands into tickets, chat messages, or documentation. Although MFA codes are short-lived, they remain sensitive authentication material during their validity period. Passing the code as an argument provides weaker confidentiality than a masked interactive prompt, protected standard-input channel, or secure credential broker. The network communication with Garmin is consistent with the Skill's declared functionality. The issue is specifically the local handling of the MFA code, rather than the necessary transmission of authentication information to Garmin. ### Attack Path 1. A user follows the documented headless-login procedure and executes `gccli` with `--mfa-code` followed by a valid code. 2. The complete command is retained in shell history, captured by terminal logging, or temporarily made available through local process inspection. 3. A local user, monitoring process, telemetry collector, or party with access to the history file obtains the MFA code. 4. Before the code expires, the party attempts to use it in a compatible Garmin authentication flow for which the other required authentication conditions are available. 5. If accepted, the party may complete an authentication attempt and obtain access associated with the affected Garmin acc ...[truncated 914 chars]- Remediation
View remediation