T09 · Insecure Skill Coding Practices
Error
- Location
- bnb.js:125
- Finding
- Private Key Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `bnb.js:125-132`, `bnb.js:162-176`; insecure usage is documented in `SKILL.md:28`, `SKILL.md:47-51`, `SKILL.md:57-62`, and `SKILL.md:68` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```javascript function getKey(args) { const keyIndex = args.indexOf('--key'); if (keyIndex !== -1 && args[keyIndex + 1]) { return args[keyIndex + 1]; } return process.env.BNB_PRIVATE_KEY; } ``` The transaction commands retrieve the private key directly from the argument list: ```javascript case 'send': const sendKey = getKey(args); if (!args[0] || !args[1] || !sendKey) throw new Error('Usage: bnb.js send <to> <amount> --key <private_key>'); await sendBNB(args[0], args[1], sendKey); break; case 'send-token': const tokenKey = getKey(args); if (!args[0] || !args[1] || !args[2] || !tokenKey) throw new Error('Usage: bnb.js send-token <token> <to> <amount> --key <private_key>'); await sendToken(args[0], args[1], args[2], tokenKey); break; case 'address': if (!args[0]) throw new Error('Usage: bnb.js address <private_key>'); getAddress(args[0]); break; ``` The documentation explicitly encourages users to provide private keys on the command line: ```bash node bnb.js send <to_address> <amount_bnb> [--key <private_key>] ``` ```bash node bnb.js send-token <token_address> <to_address> <amount> [--key <private_key>] ``` ```bash node bnb.js address <private_key> ``` ### Technical Analysis The Skill accepts wallet private keys through `process.argv`, either after `--key` or as the positional argument to the `address` command. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell command history. - Process inspection facilities while the command is running. - Process-monitoring and endpoint-management software. - Diagnostic reports, terminal recordings, audit logs ...[truncated 2082 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for private keys supplied through `--key` or positional command-line arguments. 2. Change the `address` command so that it does not require the key in `process.argv`. 3. Prefer integration with an operating-system credential store, hardware wallet, external signer, or encrypted keystore. 4. If interactive raw-key entry must be supported, read it from a TTY prompt with input echo disabled and clear references to the secret as soon as practical. 5. For non-interactive use, accept the secret through a dedicated file descriptor or protected secret-injection facility rather than command-line arguments. 6. Retain environment-variable support only when required for automation, and document that environment variables can also leak through misconfigured process managers, crash reports, CI logs, and debugging tools. 7. Update every example and usage message in `SKILL.md` and `bnb.js` to remove command-line private-key examples. 8. Add automated tests that verify private keys are rejected when supplied through positional arguments or `--key`. 9. Advise users who have already used the documented commands to review shell history and logs. If exposure is plausible, they should migrate assets and permissions to a newly generated wallet. A safer interface could prompt without echo: ```javascript const privateKey = await readSecretFromTTY('Private key: '); ``` For stronger protection, use an encrypted JSON keystore or external signer so the application never handles a plaintext private key directly. ]]>