T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:15
- Finding
- Tenant Bearer Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-20; implemented by `scripts/transfer_owner.py` through `sys.argv` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ```bash python3 ~/.qclaw/skills/feishu-doc-transfer/scripts/transfer_owner.py \ <tenant_token> \ <file_token> \ <owner_id> \ <member_type> \ [file_type] ``` The script retrieves the credential directly from its command-line arguments: ```python tenant_token = sys.argv[1] file_token = sys.argv[2] owner_id = sys.argv[3] member_type = sys.argv[4] file_type = sys.argv[5] if len(sys.argv) > 5 else "doc" ``` ### Technical Analysis The Skill instructs users and agents to place a Feishu tenant access token directly in a command string. The script then reads that bearer token from `sys.argv`. Command-line arguments are not an appropriate secret-delivery mechanism. Depending on the operating environment, the token can be exposed through: - Shell history files. - Agent command transcripts and execution logs. - Process monitoring and telemetry. - Process argument inspection by sufficiently privileged local users. - Debugging, audit, or job-scheduling systems that record full commands. The token is legitimately transmitted over HTTPS to the official Feishu endpoint in the `Authorization` header. That network transmission is necessary for the declared ownership-transfer functionality and no unrelated network destination was identified. The vulnerability is the local handling of the token before transmission, not the Feishu API request itself. ### Attack Path 1. A user or agent follows the documented invocation and places a valid tenant token in the command line. 2. The complete command is retained in shell history, agent logs, telemetry, or process metadata. 3. An attacker with access to one of those sources extracts the bearer token. 4. Before the token expires, the attacker submits authenticated requests to Feishu ...[truncated 871 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not accept the tenant token as a positional command-line argument. - Read the token from protected standard input using a non-echoing prompt, a permission-restricted secret file, an environment supplied by an approved secret manager, or a platform-native credential store. - Prefer a `--token-stdin` or `--token-file` interface and document secure invocation examples. - Ensure secret files are readable only by the intended account and are deleted securely when no longer required. - Configure OpenClaw, shell, telemetry, and job-execution logs to redact authorization credentials. - Avoid including real tokens in command examples, error messages, exception details, or returned JSON. - Grant the Feishu application only the narrowest available permissions and rotate any token suspected of appearing in logs or command history. ]]>