T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:18
- Finding
- Plaintext Secret Disclosure Through Disabled Output Masking<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-examples.md:18-20` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```bash export DB_PASSWORD="op://app-prod/db/password" op run --no-masking -- printenv DB_PASSWORD op run --env-file="./.env" -- printenv DB_PASSWORD ``` ### Technical Analysis The example resolves a database password through 1Password and passes it to `printenv`, which writes the plaintext credential to standard output. The `--no-masking` option explicitly disables 1Password CLI output redaction, making disclosure intentional at the command level. The environment-file example is similarly unsafe because `printenv DB_PASSWORD` displays the resolved secret even without the explicit masking override. When an AI agent, CI system, or terminal automation framework executes these examples, standard output may be retained in chat transcripts, build logs, shell recordings, terminal scrollback, or tmux pane captures. This behavior directly conflicts with the guardrail in `SKILL.md` that prohibits exposing secrets in logs, chat, or code. ### Attack Path 1. A user or agent follows the documented `op run` example. 2. `op` resolves the `op://app-prod/db/password` reference using the authenticated 1Password session. 3. The resolved database password is assigned to `DB_PASSWORD`. 4. `--no-masking` disables output protection, or the environment-file variant passes the secret directly to `printenv`. 5. `printenv DB_PASSWORD` emits the plaintext password to standard output. 6. The credential may be stored in agent transcripts, tmux captures, CI logs, monitoring systems, or terminal history accessible to other parties. 7. Anyone obtaining the exposed credential may attempt to authenticate to the associated database with the privileges granted to that account. ### Impact Assessment Successful exploitation discloses secrets available to the authenticated 1Password user and specifically ...[truncated 583 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--no-masking` from all examples involving sensitive values. 2. Do not use `printenv`, `echo`, shell tracing, or similar output-producing commands to verify injected secrets. 3. Replace the examples with a command that consumes the credential without displaying it, such as launching the intended database client or application through `op run`. 4. If demonstration output is necessary, print only a non-sensitive success indicator or validate that the variable is populated without revealing its value. 5. Warn users that agent output, CI logs, terminal scrollback, and tmux captures must be treated as potential disclosure channels. 6. Add a review rule prohibiting examples that combine secret resolution with output commands or masking overrides. 7. Rotate any credential that may already have been exposed by executing these examples and review relevant logs for unauthorized access. ]]>