T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/velora-chat.js:60- Finding
Velora credentials exposed through command-line arguments
- Content
View full analysis
= 4) { veloraChat(args[0], args[1], args[2], args.slice(3).join(' ')) .then(r => { console.log('\n✅ Done'); process.exit(r.success ? 0 : 1); }); } else { console.log('Usage: node velora-chat.js '); console.log('Example: node velora-chat.js test@test.com Test1234. Lilith "Hey!"'); } ``` `SKILL.md:42-54`: ```bash # Basic chat node scripts/velora-chat.js "email@domain.com" "password" "Lilith" "Hey, how are you?" # With image generation request node scripts/velora-chat.js "email@domain.com" "password" "Rin" "Send me your best photo!" ``` **Usage:** ```bash node scripts/velora-chat.js ``` ### Technical Analysis The script reads the account email and password directly from `process.argv`. Contrary to the preceding recommendation to use environment variables, the documented and implemented CLI interface requires users to put the plaintext password into the command line. Command-line arguments may be exposed through shell history, process inspection utilities, process-monitoring agents, CI job metadata, terminal transcripts, audit logs, or diagnostic data. The example containing a realistic password format also encourages this insecure usage pattern. The script does not print the supplied password itself, but that does not prevent exposure through operating-system and shell facilities outside the process. ### Attack Path 1. A user follows the documented Quick Start command and supplies a valid Velora email address and password as positional arguments. 2. The shell may retain the complete invocation in its ...[truncated 1073 chars]- Remediation
View remediation
.' ); process.exit(1); } veloraChat(email, password, args[0], args.slice(1).join(' ')); ``` ]]>