T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_inspection.py:801- Finding
Database and SSH credentials are exposed through command-line arguments
- Content
View full analysis
\ --port 3306 \ --user \ --password \ --label "" \ --inspector "" ``` The dispatcher also accepts database and SSH credentials as ordinary command-line arguments: ```python parser.add_argument('--user', help='Database username') parser.add_argument('--password', help='Database password') parser.add_argument('--ssh-user', default=None, help='SSH username (optional)') parser.add_argument('--ssh-password', default=None, help='SSH password (optional)') parser.add_argument('--ssh-key', default=None, help='SSH private-key path (optional, alternative to password)') ``` The parsed values are then retained in process memory: ```python db_info = { 'label': args.label, 'host': args.host, 'port': args.port, 'user': args.user, 'password': args.password, } if args.ssh_host: ssh_info = { 'ssh_host': args.ssh_host, 'ssh_port': args.ssh_port, 'ssh_user': args.ssh_user, 'ssh_password': args.ssh_password or '', 'ssh_key_file': args.ssh_key or '', } ``` ### Technical Analysis On common operating systems, process arguments are not a secure secret-delivery mechanism. Depending on the platform and host configuration, they may be exposed through: - Process-listing utilities such as `ps`; - `/proc//cmdline` on Linux; - Shell history; - Process accounting or endpoint monitoring; - Agent execution transcripts and orchestration logs; - Error reports that capture the invoked command. The same problem ...[truncated 1421 chars]- Remediation
View remediation