T09 · Insecure Skill Coding Practices
Warning
- Location
- references/auth-prerequisite.md:10
- Finding
- API Secret Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: - `references/auth-prerequisite.md:10-13` - `references/auth-prerequisite.md:52-55` - `references/auth-prerequisite.md:61-63` - `references/auth-prerequisite.md:131-134` - `references/auth-prerequisite.md:167-170` - `references/command-mapping.md:16-19` **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash dimens-cli auth api-key-login \ --base-url https://dimens.bintelai.com/api \ --api-key ak_xxx \ --api-secret sk_xxx ``` This command pattern is repeatedly prescribed as the standard authentication method. ### Technical Analysis The documentation directs users and AI agents to supply an API key and API secret as command-line arguments. Secrets passed this way can be exposed through: - Shell history files. - Process-listing utilities while the command is running. - Terminal session recording. - CI/CD logs and command tracing. - Agent transcripts or diagnostic logs. - Parent-process telemetry and endpoint-monitoring products. Although the examples use placeholders, users are expected to replace them with real credentials. The repeated recommendation makes accidental disclosure likely during normal use. ### Attack Path 1. A user or agent replaces `ak_xxx` and `sk_xxx` with valid credentials. 2. The authentication command is executed in an interactive shell, automated job, or agent-controlled terminal. 3. The command and its arguments are retained in shell history, logs, telemetry, or process metadata. 4. A local user, compromised monitoring process, log reader, or CI operator retrieves the exposed secret. 5. The attacker submits the recovered credentials to the documented authentication endpoint. 6. The service returns a token associated with the account bound to the API credentials. 7. The attacker accesses resources permitted to tha ...[truncated 745 chars]
- Remediation
- ## Remediation Suggestions 1. Add a secure interactive authentication mode that reads the API secret from a no-echo prompt. 2. Support reading the secret from protected standard input, for example through a `--api-secret-stdin` option. 3. Integrate with an operating-system credential store or secrets manager and reference credentials by identifier. 4. Remove direct `--api-secret VALUE` examples from documentation. 5. If environment-variable input is supported, document that environment variables may still be visible to privileged local processes and must not be printed or logged. 6. Ensure the CLI redacts API keys, API secrets, tokens, and refresh tokens from errors, debug logs, telemetry, and agent output. 7. Disable command echoing around authentication steps in automation. 8. Recommend short-lived credentials, least-privilege service identities, rotation, revocation, and audit monitoring. 9. Add automated tests verifying that secrets never appear in process output or logs.