T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bitwarden-credential.sh:22- Finding
Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
[notes]" exit 1 fi ``` The insecure invocation pattern is also explicitly documented in `SKILL.md`, lines 32-40 and 49: ```bash BW_SESSION="" ./bitwarden-credential.sh [notes] ``` ```bash ./scripts/bitwarden-credential.sh "" "" "" "[notes]" ``` ### Technical Analysis The script accepts passwords, API keys, OAuth tokens, and other secrets as positional command-line arguments. Command-line arguments are not an appropriate transport for sensitive values because they can be exposed through: - Process inspection interfaces such as `ps` or `/proc`. - Shell command history. - Agent command transcripts and execution telemetry. - Endpoint monitoring and operating-system audit logs. - CI/CD logs or debugging output that records executed commands. Quoting the arguments prevents shell word splitting but does not prevent their disclosure through process metadata or command logging. ### Attack Path 1. A user or AI agent follows the documented invocation pattern and includes a credential as the third argument. 2. The shell starts the script with the secret present in its argument vector. 3. A process monitor, local process running under an authorized account, shell-history collector, audit subsystem, or agent telemetry system records the command arguments. 4. An attacker obtains access to the process data, history, transcript, or logs. 5. The attacker extracts and reuses the password, API key, or OAuth token. ### Impact Assessment Successful exploitation discloses the cr ...[truncated 421 chars]- Remediation
View remediation