T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/secret-scan.js:55- Finding
Secret Scanner Discloses Detected Credentials in Logs
- Content
View full analysis
{ for (const re of PATTERNS) { if (re.test(line)) { hits.push({ file: rel, line: i + 1, text: line.trim().slice(0, 200) }); } } }); if (hits.length) { console.error('Potential secrets detected. Refusing to proceed.'); for (const h of hits.slice(0, 50)) { console.error(`- ${h.file}:${h.line} :: ${h.text}`); } process.exit(2); } ``` ### Technical Analysis The scanner is intended to prevent accidental publication of credentials, but it retains up to 200 characters from every matching source line and writes that content to standard error. If a match contains a real password, API key, token, or private-key material, the scanner reproduces the sensitive value in terminal output. Standard error is commonly retained by CI/CD systems, packaging services, shell transcripts, and centralized log collectors. Consequently, a secret that was initially limited to a source file can be propagated to additional systems and users with log-reading access. The scanner therefore increases the exposure scope of the exact information it is designed to protect. The finding is limited to sensitive-data disclosure. The code does not itself provide command execution, privilege escalation, persistence, or covert network exfiltration. ### Attack Path 1. A developer accidentally places a credential in a project file using syntax matched by one of the scanner's regular expressions. 2. The developer or an automated packaging pipeline runs `node scripts/secret-scan.js`, as recommended by `SKILL.md`. 3. The scanner captures the matching line, including up to 200 characters of its content. 4. The scanner prints that line to standard error. 5. A terminal recorder, CI/CD platform, build service, or centralized loggin ...[truncated 775 chars]- Remediation
View remediation