T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_weread.py:40- Finding
Authentication Cookie Exposure Through Command-Line Arguments
- Content
View full analysis
tuple[str, CookieSource]: if args.cookie: cookie = args.cookie.strip() if not cookie: raise ExportError("--cookie was provided but is empty.") return cookie, CookieSource(source="cli") ``` ### Technical Analysis The exporter accepts a live WeRead authentication cookie directly through the `--cookie` command-line option. Command-line arguments are not a secure secret transport mechanism because they may be: - Recorded in shell history. - Exposed through process-listing utilities while the exporter is running. - Collected by local process-monitoring or endpoint telemetry. - Retained in command execution logs maintained by wrappers, terminals, or automation systems. Although the implementation does not print or deliberately persist the cookie in exported JSON, accepting it as an argument creates a separate local disclosure channel. The direct CLI method is also listed as a supported input in `SPEC.md`, increasing the likelihood that users will use it. The actual transmission of the cookie to the hard-coded first-party WeRead HTTPS endpoints is necessary for the declared export functionality. The vulnerability concerns how the credential is supplied to the script, not the authenticated first-party request itself. ### Attack Path 1. A user runs the documented exporter with a command such as: ```bash python3 scripts/export_weread.py --cookie "wr_skey=...; wr_vid=..." --out data/weread-raw.json ``` 2. The complete cookie is placed in the process argument vector and may also be saved in shell history. 3. A local attacker, monitoring agent, command logger, or another acco ...[truncated 995 chars]- Remediation
View remediation