T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:12
- Finding
- Hardcoded Feishu Application Credentials Exposed in Documentation and Executable Scripts<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:12-15` - `SKILL.md:27-29` - `scripts/import_egg_cake_report.py:5-8` - `scripts/perfect_import_egg_cake.py:7-10` - `scripts/write_tangyuan.py:5-7` **Vulnerability Type**: Hardcoded application secret **Risk Level**: High ### Vulnerable Code `SKILL.md:12-15`: ```markdown ## 认证信息 使用该技能前，需确保已设置以下环境变量或在代码中显式传入： - `FEISHU_APP_ID`: cli_a92c5076b7789cd2 - `FEISHU_APP_SECRET`: 9jPdCn49G54RFoEoDPUCVcptnWZnTZqp ``` `SKILL.md:27-29`: ```python from scripts.feishu_docx_client import FeishuDocx client = FeishuDocx(app_id="cli_a92c5076b7789cd2", app_secret="9jPdCn49G54RFoEoDPUCVcptnWZnTZqp") ``` `scripts/import_egg_cake_report.py:5-8`: ```python def main(): app_id = "cli_a92c5076b7789cd2" app_secret = "9jPdCn49G54RFoEoDPUCVcptnWZnTZqp" folder_token = "CicIfQH2VlKqV0dBK4mceVMRnqf" ``` `scripts/perfect_import_egg_cake.py:7-10`: ```python def main(): app_id = "cli_a92c5076b7789cd2" app_secret = "9jPdCn49G54RFoEoDPUCVcptnWZnTZqp" folder_token = "CicIfQH2VlKqV0dBK4mceVMRnqf" ``` `scripts/write_tangyuan.py:5-7`: ```python def main(): app_id = "cli_a92c5076b7789cd2" app_secret = "9jPdCn49G54RFoEoDPUCVcptnWZnTZqp" ``` ### Technical Analysis A live-looking Feishu App ID and App Secret are embedded directly in distributed documentation and executable source files. The client submits these values to Feishu's tenant-token endpoint: ```python payload = { "app_id": self.app_id, "app_secret": self.app_secret } res = requests.post(url, json=payload) ``` Although sending credentials to Feishu's official HTTPS authentication endpoint is necessary for the declared functionality, distributing the secret in plaintext is not necessary. Anyone who can read the Skill package can extract and reuse the credentials independently of the Skill. The resulting access level depends on the permissions granted to the Feishu application. An attacker does not automatically gain unrestrict ...[truncated 1296 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed Feishu App Secret. 2. Review Feishu audit logs for token issuance and API activity involving this application. 3. Remove the secret from all documentation, scripts, examples, release artifacts, and source-control history. 4. Load credentials from environment variables or an approved secret manager: ```python app_id = os.environ["FEISHU_APP_ID"] app_secret = os.environ["FEISHU_APP_SECRET"] ``` 5. Fail safely when credentials are absent; do not provide fallback credentials. 6. Never place real secrets in example code. Use obvious placeholders such as: ```python client = FeishuDocx( app_id=os.environ["FEISHU_APP_ID"], app_secret=os.environ["FEISHU_APP_SECRET"], ) ``` 7. Restrict the Feishu application's scopes to the minimum necessary for document creation and editing. Remove Drive upload or deletion permissions if those operations are not essential. 8. Establish secret scanning in source control and CI to prevent future credential commits. 9. Use separate, short-lived credentials or applications for development and production environments. ]]>