T09 · Insecure Skill Coding Practices
Warning
- Location
lib/target.mjs:31- Finding
Feishu bearer token exposed through command-line arguments and insufficiently protected plaintext storage
- Content
View full analysis
--token ``` `scenarios/setup.mjs:32-33` ```js const token = val('--token'); const link = argv.find((a) => !a.startsWith('--') && a !== val('--table') && a !== token); ``` `lib/target.mjs:31-34` ```js export function saveTarget(obj) { fs.mkdirSync(path.dirname(TARGET_FILE), { recursive: true }); fs.writeFileSync(TARGET_FILE, JSON.stringify(obj, null, 2)); return obj; } ``` `lib/target.mjs:108-114` ```js const target = { backend: 'base-api', baseToken, talentTable: tableHint, talentTableName, personal_base_token: token, attachmentField: attachmentField || null, fields: fieldNames, configured_at: new Date().toISOString(), }; saveTarget(target); return { ok: true, target, missing, hasAttachment: !!attachmentField, backend: 'base-api' }; ``` ### Technical Analysis The setup interface requires the personal Feishu Base token to be supplied through the `--token` command-line argument. Command-line secrets can be exposed through: - Shell history files. - Process inspection while setup is running. - Terminal logging or session recording. - Automation logs that preserve the invoked command. The token is subsequently included in the target object and serialized in plaintext to `~/.opencli/boss-recruit/target.json`. The code does not explicitly create the containing directory with mode `0700` or the credential file with mode `0600`. Actual accessibility therefore depends on the user's umask, existing directory permissions, and host configuration. The token is later used as a bearer credential in `lib/feishu-base.mjs:12-17`: ```js async function bfetch(token, method, urlPath, { body, isForm } = {}) { const headers = { Authorization: `Bearer ${token}` } ...[truncated 1776 chars]- Remediation
View remediation