T09 · Insecure Skill Coding Practices
Warning
- Location
- references/payload_templates.md:50
- Finding
- Sensitive Postal Payload and Wallet Password Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `references/payload_templates.md`, lines 50-58 **Vulnerability Type**: Sensitive information exposure through process arguments **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash purl \ --wallet ~/.purl/keystores/my-wallet.json \ --password "$PURL_PASSWORD" \ --network eip155:8453 \ --max-amount 5000000 \ --output-format json \ -X POST \ --json "$(cat payload.json)" \ "https://postalform.com/api/machine/orders" ``` ### Technical Analysis The example expands both the wallet password and the complete contents of `payload.json` into the `purl` process argument vector. Although the password originates from an environment variable, `"$PURL_PASSWORD"` is expanded by the shell before process creation and passed as the value of the `--password` argument. Similarly, `$(cat payload.json)` expands the complete order payload into the `--json` argument. According to the documented payload structure, this JSON may contain: - Buyer name and email address - Sender and recipient names - Sender and recipient postal addresses - The complete PDF as base64-encoded data - Order and mailing configuration Process arguments can be captured by process inspection facilities, endpoint-monitoring software, audit systems, debugging tools, shell tracing, or crash diagnostics. The exact exposure depends on operating-system access controls and monitoring configuration, but secrets and private document contents should not be placed in command-line arguments. ### Attack Path 1. A user follows the documented `purl` command to submit a postal order. 2. The shell expands `$PURL_PASSWORD` and `$(cat payload.json)` before launching `purl`. 3. The wallet password and complete order payload become part of the process argument vector. 4. While the command is running—or through retained process telemetry—an authorized local user, administrator, monitoring agent, or com ...[truncated 1012 chars]
- Remediation
- ## Remediation Suggestions - Do not pass wallet passwords or complete postal payloads through command-line arguments. - Use a `purl` password prompt, stdin, an inherited file descriptor, or another tool-supported secret-input mechanism that does not expose the value in the argument vector. - Pass the JSON request body through stdin or a protected file-reference option rather than using `--json "$(cat payload.json)"`. - If a temporary payload file is required, create it with owner-only permissions such as mode `0600`, store it in a protected directory, and securely remove it after use. - Disable shell tracing around commands that handle sensitive values and ensure command invocations are not written to diagnostic or audit logs unnecessarily. - Prefer an OS credential store, hardware wallet, or encrypted keystore with interactive authorization over reusable plaintext passwords. - Update the documentation with a safe example supported by the selected client, and explicitly warn operators not to include passwords, PDFs, addresses, or other sensitive values in process arguments.