T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:66
- Finding
- OAuth credentials exposed through command-line arguments## Vulnerability Details **File Location**: `SKILL.md:66-73`, `SKILL.md:144-149`, and `SKILL.md:154-158` **Vulnerability Type**: Sensitive information exposure through process arguments **Risk Level**: Medium The documented commands expand OAuth authorization codes, client secrets, PKCE verifiers, and refresh tokens directly into `curl` command-line arguments. ```bash curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=authorization_code" \ -d "code=$AUTH_CODE" \ -d "redirect_uri=$REDIRECT_URI" \ -d "client_id=$CLIENT_ID" \ -d "client_secret=$CLIENT_SECRET" \ -d "code_verifier=$CODE_VERIFIER" | python3 -c " ``` ```bash curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id=$CLIENT_ID" \ -d "client_secret=$CLIENT_SECRET" \ -d "audience=$API_AUDIENCE" ``` ```bash curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=refresh_token" \ -d "refresh_token=$REFRESH_TOKEN" \ -d "client_id=$CLIENT_ID" ``` ### Technical Analysis Shell variable expansion places the credential values in the argument list of the running `curl` process. Depending on operating-system process isolation and the execution environment, these arguments may be visible through process-monitoring interfaces, diagnostic tools, endpoint monitoring, shell tracing, CI telemetry, or session recording. Supplying credentials to the selected OAuth token endpoint is necessary for the declared debugging function. Exposing those credentials through process arguments is not necessary, however, and exceeds the minimum disclosure required to conduct the request. Authorization codes and PKCE verifiers are short-lived, but client secrets and refresh tokens may remain valid for ...[truncated 1493 chars]
- Remediation
- ## Remediation Suggestions - Do not place client secrets, refresh tokens, authorization codes, or PKCE verifiers directly in process arguments. - Read sensitive request values from a protected input channel, such as a temporary `curl` configuration file with permissions set to `0600`, and securely delete the file immediately after use. - Prefer provider SDKs or a small audited helper that reads secrets from standard input or a protected credential store without exposing them in process metadata. - Disable shell tracing with `set +x` before handling credentials and ensure CI systems mask all OAuth-related variables. - Add explicit warnings against running the commands in shared terminals, recorded sessions, or untrusted CI runners. - Use short-lived credentials and revoke or rotate any client secret or refresh token suspected of exposure. - Verify `AUTH_DOMAIN` against an expected allowlist before transmitting credentials.