T09 · Insecure Skill Coding Practices
- Location
SKILL.md:61- Finding
OAuth Client Secret Exposed Through Shell Command History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 61–64
Vulnerability Type: OAuth client-secret exposure through command-line arguments
Risk Level: MediumVulnerable Code
sh curl -X POST 'https://id.twitch.tv/oauth2/token' \ -d 'client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&grant_type=client_credentials'The same unsafe pattern is repeated at
SKILL.md, lines 850–854:sh curl -X POST 'https://id.twitch.tv/oauth2/token' \ -d 'client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&grant_type=client_credentials'Technical Analysis
The instructions require users to substitute their Twitch application client secret directly into an interactive shell command. Once expanded, the secret can be retained in shell history and exposed through terminal transcripts, command auditing, copied diagnostic output, or process inspection available to other sufficiently privileged local users.
The request uses HTTPS and is directed to Twitch's declared OAuth token endpoint. Therefore, the network transfer is required for the optional IGDB integration and is not evidence of malicious exfiltration. The vulnerability is the handling of the secret on the local system before and during transmission, rather than the intended HTTPS recipient.
Attack Path
- A user replaces
YOUR_CLIENT_SECRETwith the real Twitch application secret. - The user executes the documented
curlcommand in an interactive shell. - The expanded command is retained in shell history, terminal logging, command-audit records, or observable process arguments.
- Another local user, administrator, support recipient, or log consumer obtains that record.
- The party extracts the client ID and client secret.
- The party submits those credentials to Twitch's OAuth token endpoint and requests a client-credentials access token.
- The resulting token can be used within the permissions and service sco ...[truncated 614 chars]
- A user replaces
- Remediation
View remediation
Remediation Suggestions
-
Do not place the client secret literally in an interactive command.
-
Prompt for it without terminal echo and pass it to
curlwithout embedding it in shell history. For example:sh read -rsp "Twitch client secret: " IGDB_CLIENT_SECRET printf '\n' curl --fail-with-body --silent --show-error \ -X POST 'https://id.twitch.tv/oauth2/token' \ --data-urlencode "client_id=${IGDB_CLIENT_ID}" \ --data-urlencode "client_secret=${IGDB_CLIENT_SECRET}" \ --data-urlencode 'grant_type=client_credentials' unset IGDB_CLIENT_SECRET -
Warn users that environment variables may still be visible to processes with sufficient local privileges and should not be printed or included in diagnostics.
-
Where supported, use a protected secret manager or a configuration file readable only by the current user rather than persistent command-line text.
-
Avoid enabling shell tracing while handling credentials and redact secrets from logs and error reports.
-
Document secret rotation steps so users can revoke and replace a credential after suspected exposure.
-
Apply the correction to both occurrences at lines 61–64 and 850–854.
-