T09 · Insecure Skill Coding Practices
Warning
- Location
references/telegram_setup.md:17- Finding
Insecure Persistent Storage and Exposure of API Credentials
- Content
View full analysis
/getUpdates ``` ```bash # Add to ~/.bashrc or ~/.zshrc export TELEGRAM_BOT_TOKEN="your-bot-token-here" export TELEGRAM_CHAT_ID="your-chat-id-here" # Optional: Increase the GitHub API rate limit export GITHUB_TOKEN="your-github-token-here" ``` ```bash source ~/.bashrc ``` ```bash curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -d chat_id="${TELEGRAM_CHAT_ID}" \ -d text="Test message" \ -d parse_mode="MarkdownV2" ``` ### Technical Analysis The setup guide instructs users to store the Telegram bot token and an optional GitHub token in plaintext shell startup files. Secrets exported from `.bashrc` or `.zshrc` persist across sessions and are inherited by every descendant process launched from the shell. This unnecessarily increases the number of processes and tools that can access the credentials. The included implementation does not consume `GITHUB_TOKEN`, so requesting and persistently exporting that credential exceeds the minimum privileges and credentials required by the current Skill. The guide also instructs users to place the Telegram bot token in a browser-accessed URL and in a curl command URL. A token embedded in a URL may be retained in browser history, synchronized browser data, diagnostic telemetry, proxy logs, or monitoring systems. A token expanded into a command line may also be exposed through shell history or process inspection, depending on how the command is executed and the operating system configuration. HTTPS protects the credentials while in transit to Telegram, but it does not mitigate disclosure from local storage, process metadata, browser history, logs, or backups. ### Attack Path 1. A user follow ...[truncated 1519 chars]- Remediation
View remediation