T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:10
- Finding
- Decrypted 1Password secrets may be exposed through captured output and plaintext files## Vulnerability Details **File Location**: `references/cli-examples.md`, lines 10-23 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High **Complete Code Snippet**: ```bash - `op read op://app-prod/db/password` - `op read "op://app-prod/db/one-time password?attribute=otp"` - `op read "op://app-prod/ssh key/private key?ssh-format=openssh"` - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject - `echo "db_password: {{ op://app-prod/db/password }}" | op inject` - `op inject -i config.yml.tpl -o config.yml` ``` ### Technical Analysis The documented `op read` examples emit decrypted passwords, one-time passwords, and private keys directly to standard output. In an AI-agent environment, command output is commonly captured in tool responses, execution logs, terminal scrollback, or conversation transcripts. Consequently, following these examples can move secrets out of 1Password's protected storage and into less-protected records. The command `op run --no-masking -- printenv DB_PASSWORD` presents a particularly direct disclosure path: it explicitly disables 1Password's output masking and then prints the decrypted database password. This behavior conflicts with the guardrail in `SKILL.md` that states secrets must never be pasted into logs or chat. The `--out-file ./key.pem` and `op inject -o config.yml` examples also persist decrypted material to ordinary filesystem paths. The documentation does not require restrictive permissions, a private temporary directory, secure cleanup, or protection against pre-existing files and symbolic links. Such files can remain accessible through local users, other processes, backups, workspace collection, or later agent tasks. ### Attack Path 1. An agent follows one of the do ...[truncated 1487 chars]
- Remediation
- ## Remediation Suggestions 1. Remove examples that print decrypted secrets directly to standard output, especially passwords, OTP values, and private keys. 2. Remove `--no-masking -- printenv DB_PASSWORD`; never disable output masking when a command can emit secret-bearing values. 3. Demonstrate `op run` using a real application that consumes the environment variable without printing it, and explicitly warn users not to enable shell tracing or verbose environment logging. 4. Prefer process-local secret delivery through `op run` or in-memory pipelines over persistent output files. 5. When a file is unavoidable, create it in a private directory with `umask 077`, enforce mode `0600`, reject unsafe pre-existing paths or symbolic links, minimize its lifetime, and guarantee cleanup with a shell trap. 6. Add an explicit warning that command output may be captured by agent tools, tmux `capture-pane`, CI systems, terminal logs, and conversation transcripts. 7. Replace disclosure-oriented examples with non-sensitive verification commands such as `op whoami`, `op vault list`, or commands that report only successful secret injection without displaying the resulting value. 8. Rotate any credential that may already have been exposed through logs, transcripts, generated files, or terminal captures.