T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ncm_env.py:325- Finding
Authenticated CDP debugging interface remains active after collection
- Content
View full analysis
list[str]: common_args = [ "--force-renderer-accessibility=complete", f"--remote-debugging-port={port}", ] if client.platform == "windows": return [str(client.path), *common_args] if client.platform == "macos": return ["open", "-na", str(client.path), "--args", *common_args] raise UserActionRequired( "Unsupported platform for this Skill. NetEase Cloud Music desktop collection " "is supported on Windows and macOS." ) def launch_client(client: NcmClient, port: int) -> subprocess.Popen: args = client_launch_args(client, port) return subprocess.Popen(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) ``` The collection cleanup only closes the current WebSocket connection: ```python finally: if client is not None: client.close() ``` ### Technical Analysis The Skill launches NetEase Cloud Music with Chrome DevTools Protocol enabled on TCP port 9222. CDP permits target enumeration, arbitrary JavaScript evaluation, and interaction with an authenticated application context. Closing `CdpClient` only closes the Python process's WebSocket. It does not disable the debugging endpoint or close the Skill-launched desktop client. The returned `subprocess.Popen` object is not retained by the collector, so the collector cannot perform targeted lifecycle cleanup after final collection. Keeping the client running is temporarily necessary between playlist listing and final collection, but leaving CDP enabled after the final collection exceeds the minimum duration required by the declared functionality. Exploitation requires local access to the debugging ...[truncated 1360 chars]- Remediation
View remediation