T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate-secret.js:14
- Finding
- TOTP Enrollment Secret Exposed Through Standard Output and a Predictable QR File## Vulnerability Details **File Location**: `scripts/generate-secret.js`, lines 14-30; related cleanup guidance in `SKILL.md`, lines 31-34 **Vulnerability Type**: Plaintext credential exposure and unsafe sensitive-file handling **Risk Level**: Medium The generated TOTP enrollment secret is printed twice to standard output and encoded in a QR image stored at the predictable project-relative path `qr.png`. The script does not explicitly apply restrictive file permissions or guarantee automatic deletion of the QR image. **Complete vulnerable code snippet (`scripts/generate-secret.js`, lines 14-30):** ```js QRCode.toFile(qrPath, otpauth, { type: 'png', width: 200, margin: 2 }, (err) => { if (err) { console.error('Failed to generate QR image:', err.message); process.exit(1); } console.log('New TOTP_SECRET:'); console.log(secret); console.log(`\nQR code saved to: ${qrPath}`); console.log('\nManual setup:'); console.log('1. Open Google Authenticator/Authy'); console.log('2. Tap "+" > "Enter a setup key"'); console.log(`3. Account: ${account}`); console.log('4. Key:', secret); console.log('5. Type: Time-based (TOTP)'); console.log('\nAdd this line to your .env:'); console.log(`TOTP_SECRET=${secret}`); }); ``` **Related manual-cleanup guidance (`SKILL.md`, lines 31-34):** ```markdown 3. **Send the QR image** (`qr.png`) to the user, then delete it immediately: ```bash rm qr.png ``` ``` ### Technical Analysis A TOTP enrollment secret is a reusable authentication credential. Anyone possessing it can independently generate valid one-time passwords for every future time interval until the secret is rotated. The generator discloses this credential through two channels: 1. It prints the Base32 secret directly to standard output twice. Terminal transcripts, agent conversation records, CI logs, process wrappers, or redirected output may retain this value ...[truncated 2246 chars]
- Remediation
- ## Remediation Suggestions 1. Do not print the TOTP secret by default. If manual display is necessary, require an explicit option and warn that the output is sensitive. 2. Avoid emitting the secret through logging facilities, agent transcripts, or CI systems. Prefer direct enrollment through a trusted, interactive channel. 3. Create any QR image in a securely created temporary directory with owner-only permissions. Explicitly set restrictive permissions such as mode `0600` rather than relying on the process umask. 4. Use a unique, unpredictable temporary filename instead of a fixed project-root path. 5. Remove the QR image automatically after enrollment using guaranteed cleanup logic, including error and signal handling. Manual deletion should only be a fallback. 6. Consider displaying the QR code through an ephemeral local interface that does not persist it to disk. 7. Document that generated output and QR images are credentials and must not be uploaded, attached to tickets, retained in logs, or shared through untrusted channels. 8. Rotate `TOTP_SECRET` immediately if the console output or QR image may have been exposed, and invalidate the previous secret in every consuming environment. 9. Restrict access to the environment or secret store containing `TOTP_SECRET`, and ensure the surrounding authorization layer does not treat TOTP as the sole control for highly destructive operations.