T09 · Insecure Skill Coding Practices
- Location
scripts/generate-secret.js:14- Finding
TOTP Enrollment Secret Exposed Through Standard Output and a Predictable QR File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate-secret.js, lines 14-30; related cleanup guidance inSKILL.md, lines 31-34
Vulnerability Type: Plaintext credential exposure and unsafe sensitive-file handling
Risk Level: MediumThe generated TOTP enrollment secret is printed twice to standard output and encoded in a QR image stored at the predictable project-relative path
qr.png. The script does not explicitly apply restrictive file permissions or guarantee automatic deletion of the QR image.Complete vulnerable code snippet (
scripts/generate-secret.js, lines 14-30):js QRCode.toFile(qrPath, otpauth, { type: 'png', width: 200, margin: 2 }, (err) => { if (err) { console.error('Failed to generate QR image:', err.message); process.exit(1); } console.log('New TOTP_SECRET:'); console.log(secret); console.log(`\nQR code saved to: ${qrPath}`); console.log('\nManual setup:'); console.log('1. Open Google Authenticator/Authy'); console.log('2. Tap "+" > "Enter a setup key"'); console.log(`3. Account: ${account}`); console.log('4. Key:', secret); console.log('5. Type: Time-based (TOTP)'); console.log('\nAdd this line to your .env:'); console.log(`TOTP_SECRET=${secret}`); });Related manual-cleanup guidance (
SKILL.md, lines 31-34):markdown 3. **Send the QR image** (`qr.png`) to the user, then delete it immediately: ```bash rm qr.png ```Technical Analysis
A TOTP enrollment secret is a reusable authentication credential. Anyone possessing it can independently generate valid one-time passwords for every future time interval until the secret is rotated.
The generator discloses this credential through two channels:
- It prints the Base32 secret directly to standard output twice. Terminal transcripts, agent conversation records, CI logs, process wrappers, or redirected output may retain this value ...[truncated 2246 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not print the TOTP secret by default. If manual display is necessary, require an explicit option and warn that the output is sensitive.
- Avoid emitting the secret through logging facilities, agent transcripts, or CI systems. Prefer direct enrollment through a trusted, interactive channel.
- Create any QR image in a securely created temporary directory with owner-only permissions. Explicitly set restrictive permissions such as mode
0600rather than relying on the process umask. - Use a unique, unpredictable temporary filename instead of a fixed project-root path.
- Remove the QR image automatically after enrollment using guaranteed cleanup logic, including error and signal handling. Manual deletion should only be a fallback.
- Consider displaying the QR code through an ephemeral local interface that does not persist it to disk.
- Document that generated output and QR images are credentials and must not be uploaded, attached to tickets, retained in logs, or shared through untrusted channels.
- Rotate
TOTP_SECRETimmediately if the console output or QR image may have been exposed, and invalidate the previous secret in every consuming environment. - Restrict access to the environment or secret store containing
TOTP_SECRET, and ensure the surrounding authorization layer does not treat TOTP as the sole control for highly destructive operations.