T09 · Insecure Skill Coding Practices
Warning
- Location
inject-server-context.sh:12- Finding
Bearer Token and Open-Document Metadata Exposed in Agent Context
- Content
View full analysis
/dev/null) || exit 0 [ -n "$port" ] && [ -n "$token" ] || exit 0 context="The tldraw desktop canvas server is running at http://localhost:$port. Send the header 'Authorization: Bearer $token' on every request except GET / and /readme. Use these values directly — you do not need to read server.json." # Snapshot the open documents so the agent starts knowing what canvases exist. # Best-effort: a dead server, missing curl, or a slow response must not delay # or fail the subagent launch. docs="" if command -v curl >/dev/null 2>&1; then docs=$(curl -s --max-time 2 -X POST "http://localhost:$port/api/search" \ -H 'content-type: text/plain' \ -H "authorization: Bearer $token" \ --data-binary 'return await api.getDocs()' 2>/dev/null | jq -c '.result // empty' 2>/dev/null) fi if [ -n "$docs" ] && [ "$docs" != "[]" ]; then context="$context The user's currently open tldraw offline canvases (most-recently-active first): $docs" fi jq -n --arg event "$event" --arg context "$context" \ '{hookSpecificOutput: {hookEventName: $event, additionalContext: $context}}' ``` ### Technical Analysis The hook reads the tldraw bearer token from `/home/fslong/.config/tldraw/server.json` and interpolates it directly into `additionalContext`. It also uses that credential to retrieve the list of open documents and adds the returned metadata to the same model-visible context. The bearer token authorizes local API operations beyond simple document discovery. The documented API includes endpoints that execute JavaScript, edit and save documents, create files, and install persistent document-level scripts. Consequently, the token should be treated as a sensitive session credential. Al ...[truncated 2096 chars]- Remediation
View remediation