T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:326
- Finding
- Plaintext Administrative Database Credential Embedded in Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:326-327` **Vulnerability Type**: Hardcoded plaintext credential **Risk Level**: High ### Vulnerable Code ```bash --user root \ --password "Xszyh@315315" \ ``` ### Technical Analysis The documentation contains a realistic plaintext password associated with the TiDB `root` account. Even if intended only as an example, it cannot be established from the repository that the credential is fictitious, expired, or isolated. Publishing it exposes the secret to every person and system with access to the Skill package. The example also promotes passing passwords through command-line arguments. Command-line secrets may be retained in shell history, terminal logs, CI logs, audit records, or process listings. Use of the database `root` account violates least-privilege principles because SQL replay generally requires access only to a designated test schema and a controlled subset of SQL operations. ### Attack Path 1. An attacker obtains the Skill package or reads `SKILL.md`. 2. The attacker extracts the documented username and password. 3. The attacker identifies an accessible TiDB endpoint associated with the project or tests the credential against environments where it may have been reused. 4. If valid, the attacker authenticates as `root`. 5. The attacker reads, modifies, or destroys any database resources available to that account. ### Impact Assessment If the credential is valid or reused, exploitation may grant full administrative access to a TiDB deployment. Potential consequences include: - Disclosure of all accessible database contents. - Modification or deletion of schemas and records. - Creation of additional accounts or privilege grants. - Disruption of migration and replay environments. - Credential reuse attacks against other systems. The potential privilege scope is especially broad because the documented account is `root`. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately determine whether the exposed password has ever been valid. 2. Revoke or rotate the credential in every environment where it may have been used. 3. Replace it with an unmistakable placeholder such as `${TIDB_PASSWORD}` or `<REDACTED_TEST_PASSWORD>`. 4. Remove the credential from Git history, package caches, release artifacts, and generated documentation where feasible. 5. Do not recommend the TiDB `root` account. Create a dedicated replay account restricted to: - A disposable test database. - Only the required tables and operations. - Approved source hosts. - A limited validity period. 6. Retrieve credentials from a protected secret manager or prompt for them interactively. 7. Avoid passing secrets through command-line arguments. If environment variables are supported, warn that they may still be exposed in process environments and CI diagnostics. 8. Add automated secret scanning to repository and release workflows. ]]>