T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/booking-api.sh:47
- Finding
- Sensitive Patient Data Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/booking-api.sh:47-56` **Related Documentation**: `SKILL.md:136-142`, `SKILL.md:167-169` **Vulnerability Type**: Sensitive data exposure through process arguments and command logging **Risk Level**: High ### Vulnerable Code ```bash book|book-dry) json="${1:-}" [ -z "$json" ] && error "Usage: booking-api.sh book '<json-payload>'" url="${BASE_URL}/api/v1/book" [ "$command" = "book-dry" ] && url="${url}?mode=dry_run" curl -s -X POST \ -H "Content-Type: application/json" \ -d "$json" \ "$url" | python3 -m json.tool ``` The documented invocation explicitly places the complete patient record in a command-line argument: ```bash scripts/booking-api.sh book '{"provider_id":"...","session_id":"...","service":"...","slot":"...","patient_first_name":"...","patient_last_name":"...","patient_email":"...","patient_phone":"...","patient_dob":"...","patient_state":"...","insurance_carrier":"...","insurance_member_id":"..."}' ``` ### Technical Analysis The booking payload contains sensitive identity, contact, insurance, and healthcare information, including: - Patient name - Date of birth - Email address - Telephone number - State - Requested mental-health service - Insurance carrier - Insurance member or subscriber ID The script accepts this complete JSON document through `$1`. Consequently, it appears in the argument list of the shell script process. The script then supplies the same value to `curl` using `-d "$json"`, exposing the payload in the `curl` process argument list as well. Depending on the execution environment, command arguments may be captured by: - Agent tool-call or execution telemetry - Shell command history when invoked interactively - Process-monitoring and endpoint-observability systems - Debug traces such as `set -x` - Audit logging or error-reporting infrastructure - Local users or services permitted to inspect same-user processes This beh ...[truncated 1927 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Accept booking data only through standard input.** Do not accept sensitive JSON as a positional command-line argument. For example: ```bash book|book-dry) [ "$#" -eq 0 ] || error "Pass the booking payload through standard input" url="${BASE_URL}/api/v1/book" [ "$command" = "book-dry" ] && url="${url}?mode=dry_run" curl --silent --show-error --fail-with-body \ -X POST \ -H "Content-Type: application/json" \ --data-binary @- \ "$url" | python3 -m json.tool ;; ``` 2. **Update the documented invocation** so that the payload is supplied through a protected standard-input channel rather than written literally into an interactive command. The invoking agent should use an execution interface capable of providing stdin separately from command metadata. 3. **Avoid intermediate files.** If a temporary file is unavoidable, create it with restrictive permissions such as mode `0600`, store it only in a trusted local directory, and remove it reliably with a signal-safe cleanup trap. 4. **Disable and prohibit shell tracing** around booking operations. Ensure neither the script nor its caller enables `set -x`, because tracing can disclose stdin-derived values if they are later expanded in shell commands. 5. **Redact execution telemetry.** Configure the agent runtime, process supervisor, audit pipeline, and error-reporting system not to record booking request bodies, stdin, expanded environment variables, or API responses containing patient data. 6. **Minimize in-memory copies.** Stream the request body directly from stdin to `curl` with `--data-binary @-` instead of storing the complete payload in a shell variable. 7. **Strengthen transport error handling.** Use `--fail-with-body`, `--show-error`, and appropriate connection and request timeouts so failed HTTP responses are handled explicitly without encouraging diagnostic logging of the sensitive request body. 8. **Add regression tests** that inspect spaw ...[truncated 163 chars]