T09 · Insecure Skill Coding Practices
- Location
scripts/secret-exposure-audit.sh:202- Finding
Hardcoded Credentials Are Exposed in JSON Audit Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/secret-exposure-audit.sh, lines 202–205 and 268
Vulnerability Type: Plaintext sensitive-data exposure through audit output
Risk Level: MediumVulnerable Code
python hardcoded_match = hardcoded_credential_re.match(line) if hardcoded_match and '${{' not in line and '$' not in line: hardcoded_credential_lines.append({'line': idx, 'text': stripped})The resulting record is later serialized without redaction:
python if output_format == 'json': print(json.dumps({'summary': summary, 'workflows': rows[:top_n], 'all_workflows': rows, 'critical_workflows': critical_rows}, indent=2, sort_keys=True))Technical Analysis
When the scanner identifies a likely hardcoded credential, it stores the entire source line in the
textfield. That line includes the suspected credential value rather than only its location and key name.In JSON mode, the complete finding objects are serialized to standard output. Consequently, a tool intended to detect secret exposure can reproduce plaintext credentials in CI logs, terminal captures, uploaded artifacts, or downstream reporting systems.
The bundled test fixture demonstrates the behavior at
fixtures/risky-pr-target.yml:21:yaml DEPLOY_PASSWORD: supersecretpassword123The fixture value is demonstrative rather than evidence of a production credential, but a real scanned workflow with the same pattern would have its value copied into the JSON report.
Attack Path
- A repository workflow contains a hardcoded credential matching the scanner's credential pattern.
- CI or a developer runs the scanner with
OUTPUT_FORMAT=json. - The scanner matches the credential-bearing line and stores the complete line in
hardcoded_credential_lines. - JSON serialization writes the unredacted line to standard output.
- CI captures that output in logs or stores it as an audit artifact.
- A user or integrated system with access to audit outpu ...[truncated 698 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not retain the complete source line for hardcoded-credential findings.
- Store only non-sensitive metadata, such as the file path, line number, detected key name, and finding type.
- Redact the value before constructing the finding object, for example:
python credential_key = hardcoded_match.group(1) hardcoded_credential_lines.append({ 'line': idx, 'key': credential_key, 'text': f'{credential_key}: [REDACTED]', })- Prefer parsing the key separately from the value so that no credential value enters the report data model.
- Apply redaction at collection time rather than only during JSON rendering. This ensures that future output formats cannot accidentally expose retained plaintext.
- Add regression tests verifying that known fixture values never appear in text or JSON output.
- Configure CI systems to treat audit reports as sensitive until existing logs and artifacts have been checked for prior exposure.
- If real credentials have already appeared in generated reports, remove affected logs or artifacts where possible and rotate those credentials.