T09 · Insecure Skill Coding Practices
- Location
SKILL.md:57- Finding
Database Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:57-66; additional examples atSKILL.md:75-78,README.md:16-22, andREADME.md:47-48
Vulnerability Type: Plaintext sensitive data in process arguments
Risk Level: MediumVulnerable documentation snippet:
bash # Compare two database connections python3 scripts/main.py compare postgresql://user:pass@host1/db postgresql://user:pass@host2/db # Generate migration script from schema differences python3 scripts/main.py diff dev_db.sql prod_db.sql --output migration.sql # Create schema snapshot for future comparison python3 scripts/main.py snapshot postgresql://user:pass@host/db --save snapshot.jsonTechnical Analysis
The documented interface instructs users to embed database usernames and passwords directly in positional command-line arguments. Command-line arguments are commonly exposed through shell history, process inspection utilities, operating-system process metadata, CI/CD logs, terminal recordings, and command-auditing systems.
The CLI accepts these values as ordinary strings. Although the current implementation does not support live database connections, users following the advertised interface may still provide genuine production credentials. This makes disclosure possible without requiring successful database connectivity.
Attack Path
- A user follows the documented example and substitutes a real database username and password into the connection URL.
- The shell records the complete command in its history, or a CI/CD system records it in job logs.
- While the process is running, another authorized local user or monitoring process may inspect its command-line arguments.
- An attacker or unauthorized log consumer retrieves the plaintext database URL.
- The attacker uses the disclosed credentials to connect to the database, subject to network reachability and the account's assigned permissions.
Impact Assessment
...[truncated 396 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place passwords or other secrets in command-line arguments.
- Accept secrets through an interactive password prompt using a non-echoing facility such as Python's
getpass. - Support protected environment variables, operating-system credential stores, or dedicated secret-management services.
- Permit connection URLs without embedded passwords and obtain the password through a separate secure channel.
- Update all examples to use redacted or passwordless URLs.
- Ensure diagnostic messages redact user information, passwords, tokens, and sensitive URL query parameters.
- Warn users to remove any previously entered credentials from shell history and rotate credentials that may have entered logs.
- In CI/CD environments, use masked secret variables and disable command tracing around secret-handling operations.