T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/audit-env-aliases.sh:82
- Finding
- Sensitive Environment Values Disclosed in Audit Output## Vulnerability Details **File Location**: `scripts/audit-env-aliases.sh:82-87, 113-116, 136, 145-147` **Vulnerability Type**: Sensitive information exposure through terminal and log output **Risk Level**: Medium ### Vulnerable Code ```python def short(value: str): if value == '': return '(empty)' if len(value) <= 16: return value return value[:8] + '…' + value[-4:] ``` ```python if len(distinct) > 1: preview = ', '.join([f'{k}={short(v)}' for k, v in present]) failures.append(f'{canonical}: conflicting values across aliases ({preview})') print(f'FAIL {canonical} -> conflict across {len(present)} keys') continue ``` ```python print(f'OK {canonical} -> ' + (short(present[0][1]) if present else 'unset')) ``` ```python if failures: print('FAILURES:', file=sys.stderr) for item in failures: print(f'- {item}', file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The script reads potentially sensitive values from `.env` files, including Stripe API keys, webhook secrets, and database connection URLs. The `short()` function is intended to abbreviate those values, but it prints values of 16 characters or fewer in full. For longer values, it exposes the first eight and final four characters. This function is used in normal successful status output and when constructing conflict diagnostics. Consequently, secret material is written to standard output or standard error, where it can be captured by CI/CD systems, deployment logs, terminal recording, build artifacts, or centralized logging services. Truncation is not an adequate security control. Prefixes and suffixes may identify credentials, reveal structural information, facilitate correlation across systems, or reduce the search space for guessing attacks. Database URLs may also expose usernames, hostnames, database names, and portions of embedded passwords. ### Attack Path 1. A user or automated CI/CD process runs the documented ...[truncated 1752 chars]
- Remediation
- ## Remediation Suggestions 1. Never include environment values, whether complete or truncated, in routine status, warning, or error output. 2. Replace value-bearing output with state-only messages. For example: ```python if len(distinct) > 1: conflicting_keys = ', '.join(k for k, _ in present) failures.append( f'{canonical}: conflicting values across keys ({conflicting_keys})' ) ``` 3. Change successful output to report only whether a group is set: ```python print(f'OK {canonical} -> ' + ('set' if present else 'unset')) ``` 4. Remove the `short()` function after all value-rendering call sites have been eliminated. 5. Ensure conflict diagnostics list only variable names, never their values. 6. Add automated tests that populate the input file with unique sentinel secrets, execute every status path, and assert that neither complete values nor substrings appear in standard output or standard error. 7. Review CI/CD log retention and access controls, and purge historical logs containing output from affected executions where feasible. 8. Rotate credentials if prior audit output may have been retained or exposed, prioritizing any credentials short enough to have been printed completely.