T09 · Insecure Skill Coding Practices
Error
- Location
- references/troubleshooting.md:12
- Finding
- MCP troubleshooting procedure exposes configured API credentials<![CDATA[ ## Vulnerability Details **File Location**: `references/troubleshooting.md`, lines 12–22 **Vulnerability Type**: Credential disclosure through unsafe diagnostic output **Risk Level**: High ### Vulnerable Code ```python # 查看当前配置（mcporter 会加载这两个文件） python3 << 'EOF' import json, os for path in ['~/.cursor/mcp.json', '~/.claude.json']: p = os.path.expanduser(path) if not os.path.exists(p): continue d = json.load(open(p)) cfg = d.get('mcpServers', {}).get('douyin-mcp') if cfg: print(f"Found in {path}:", json.dumps(cfg, indent=2, ensure_ascii=False)) EOF ``` ### Technical Analysis The troubleshooting procedure reads the `douyin-mcp` configuration from `~/.cursor/mcp.json` and `~/.claude.json` and serializes the complete configuration object to standard output. The documented configuration format stores either `DOUYIN_API_KEY` or `DASHSCOPE_API_KEY` inside the `env` object. Consequently, `json.dumps(cfg, ...)` prints the plaintext API credential along with the remaining configuration. Displaying the complete configuration is unnecessary for diagnosing a version mismatch. The relevant information is limited to the configured command arguments and the names—not values—of environment variables. ### Attack Path 1. A user encounters an invalid API-key or configuration error. 2. The user or agent executes the documented troubleshooting command. 3. The script reads a configuration file containing a plaintext API key. 4. The entire `douyin-mcp` configuration, including the key value, is written to standard output. 5. The output may be retained in terminal scrollback, execution logs, shell-capture systems, support tickets, or agent tool transcripts. 6. A party with access to those records can recover and misuse the credential. ### Impact Assessment An exposed key may allow unauthorized use of the associated SiliconFlow or Alibaba Cloud Model Studio account. The resulting scope depends on the key's provider-side permissions and can ...[truncated 298 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never serialize the complete MCP configuration. - Print only non-sensitive fields required for diagnosis, such as `args` and environment-variable names: ```python if cfg: print(f"Found in {path}") print(" args:", cfg.get("args")) print(" env keys:", list(cfg.get("env", {}).keys())) ``` - Apply recursive redaction before displaying configuration data. Treat field names containing `key`, `token`, `secret`, `password`, or `credential` as sensitive. - Warn users not to paste unredacted MCP configurations into support channels or agent conversations. - If the existing procedure has been used, advise affected users to review captured logs and rotate potentially disclosed credentials. ]]>