T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:44- Finding
Insecure Collection, Storage, and Transmission Handling of API Credentials and Bearer Tokens
- Content
View full analysis
/dev/null ``` ### First-Time Setup — Guide the User If the config file doesn't exist, reply to the user: > This is a paid service. Please visit https://www.shopdora.com and contact official customer service to get your token. Once you have your `clientId` and `clientSecret`, share them with me and I'll set it up. After receiving the credentials, create the config file: ```bash mkdir -p ~/.shopdora ``` Then write the JSON config with the user-provided `clientId` and `clientSecret`. ### Config File Format ```json { "clientId": "std_xxxxxxxx", "clientSecret": "your_secret_here" } ``` ``` The access token is also persisted as plaintext and credentials are inserted into a command argument: ```markdown The token is stored in `~/.shopdora/token.json`: ```json { "accessToken": "a1b2c3d4e5f6...", "tokenType": "Bearer", "expiresIn": 2678400, "obtainedAt": 1753718400 } ``` **API call:** ```bash curl -s -X POST 'https://openapi.shopdora.cn/openapi/standard/token' \ -H 'Content-Type: application/json' \ -d '{"clientId":"","clientSecret":""}' ``` ``` ### Technical Analysis The Skill instructs users to disclose a long-lived `clientSecret` directly to the agent and then stores that secret in `~/.shopdora/config.json`. It similarly stores the reusable bearer token in `~/.shopdora/token.json`. No requirement is given to create `~/.shopdora` with mode `0700` or the secret-bearing files with mode `0600`. Consequently, actual accessibility depends on the host's umask and the unspecified method used to write the files. On a shared or improperly configured sy ...[truncated 2644 chars]- Remediation
View remediation