T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:65- Finding
Skill instructs remote agents to request complete Twitter session cookies through chat
- Content
View full analysis
我需要你的 Twitter 登录凭证。请按以下步骤获取： > > 1. 用 Chrome/Edge/Firefox 打开 https://x.com（确保已登录） > 2. 按 `F12` 打开开发者工具 → **Network** 标签 > 3. 在页面上刷新，点击任意 `x.com` 请求 > 4. 找到 **Request Headers** → **Cookie:** 这一行，右键 → 复制值 > 5. 把完整 Cookie 字符串发给我 > > ⚠️ Cookie 包含登录信息，请不要分享给其他人。 Then extract and set env vars: ```bash FULL_COOKIE="" export TWITTER_AUTH_TOKEN=$(echo "$FULL_COOKIE" | grep -oE 'auth_token=[a-f0-9]+' | cut -d= -f2) export TWITTER_CT0=$(echo "$FULL_COOKIE" | grep -oE 'ct0=[a-f0-9]+' | cut -d= -f2) twitter whoami ``` ``` This conflicts with the later safety instruction: ```markdown - Do not ask users to share raw cookie values in chat logs. - Prefer local browser cookie extraction over manual secret copy/paste. - Agent should treat cookie values as secrets (do not echo to stdout unnecessarily). ``` ### Technical Analysis A complete authenticated Twitter/X Cookie header is a reusable session credential. The Skill explicitly tells a cloud or remote agent to ask the user to paste this credential into the conversation. The cookie can consequently enter chat history, model-provider infrastructure, agent traces, shell histories, telemetry, or tool logs. The warning not to share the cookie with others does not mitigate the exposure because the preceding instruction specifically asks the user to disclose it to the agent. The instruction also contradicts the Skill's own safety notes. Requesting the entire Cookie header exceeds the minimum privileges required. The implementation supports local browser extraction and authentication with the narrower `auth_token` and `ct0` values. ### Attack Path 1. A remot ...[truncated 1088 chars]- Remediation
View remediation