T09 · Insecure Skill Coding Practices
- Location
SKILL.md:63- Finding
Database Credentials May Be Exposed Through Insecure Storage Guidance
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 63–77
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: MediumVulnerable Code
ini [client] host = localhost user = your_username password = your_password database = your_databasebash export MYSQL_HOST=localhost export MYSQL_USER=your_username export MYSQL_PASSWORD=your_password export MYSQL_DATABASE=your_databaseTechnical Analysis
The Skill recommends placing a plaintext MySQL password in
~/.my.cnfbut does not instruct the user to restrict that file's permissions. If the file is readable by other local users or is included in an insecure backup, the database credentials can be disclosed.The alternative recommendation exports the password through the
MYSQL_PASSWORDenvironment variable. Environment variables may be inherited by child processes or captured by diagnostic tools, process inspection facilities, crash reports, shell configuration files, and CI/CD logs. Persisting the export command in a shell initialization file would further increase the exposure period.The example values are placeholders rather than embedded real credentials. The risk arises when users replace them with operational credentials while following the documented configuration procedure.
Attack Path
- A user follows the Skill instructions and replaces
your_passwordwith a valid MySQL password. - The user saves the password in
~/.my.cnfwithout restrictive permissions or exports it into a broadly observable process environment. - An attacker with access to another local account, an exposed backup, a diagnostic artifact, or a process capable of inspecting the environment obtains the credential.
- The attacker connects to the configured MySQL server using the disclosed username and password.
- The attacker performs operations allowed by that database account.
This exploitation path requires access to the credential-bearing host, its backups or di ...[truncated 760 chars]
- A user follows the Skill instructions and replaces
- Remediation
View remediation
Remediation Suggestions
- Require restrictive permissions when using an option file:
bash touch ~/.my.cnf chmod 600 ~/.my.cnf- Prefer MySQL's encrypted login-path facility instead of directly documenting plaintext password storage:
bash mysql_config_editor set \ --login-path=mysql-skill \ --host=localhost \ --user=your_username \ --passwordThen connect with:
bash mysql --login-path=mysql-skill your_database-
Avoid recommending persistent
MYSQL_PASSWORDexports. If environment-based injection is unavoidable, provide the secret only to the required process through a dedicated secret manager and remove it immediately afterward. -
Warn users not to place credentials in shell history, command-line arguments, source-controlled files, logs, or unencrypted backups.
-
Require a dedicated least-privilege MySQL account. Read-only workflows should use an account with only the required
SELECTprivileges. Schema changes, restores, destructive writes, and global settings should use separately controlled privileged accounts. -
Recommend credential rotation if the option file, environment, logs, diagnostics, or backups may already have exposed the password.