T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ticktick.ts:35- Finding
OAuth Client Secret Exposed Through Command-Line Arguments
- Content
View full analysis
", "TickTick OAuth client ID") .option("--client-secret ", "TickTick OAuth client secret") ``` `scripts/ticktick.ts:57-58`: ```ts if (options.clientId && options.clientSecret) { await setupCredentials(options.clientId, options.clientSecret); } ``` `SKILL.md:17`: ```bash bun run scripts/ticktick.ts auth --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET ``` ### Technical Analysis The CLI accepts the TickTick OAuth client secret as a command-line argument, and the documented setup procedure explicitly instructs users to place the secret directly in the command. Command-line secrets can be exposed through: - Shell history files. - Process inspection utilities available to the same user or, depending on the operating system configuration, other local users. - Terminal session recording. - Command auditing and endpoint telemetry. - Automation logs that record invoked commands. - Error reports or support transcripts containing copied command lines. The subsequent storage code applies restrictive filesystem permissions, but those permissions do not protect the secret while it is being supplied through the process argument vector. ### Attack Path 1. A user follows the documented authentication command and includes the real client secret after `--client-secret`. 2. The shell records the complete command in its history, or local monitoring captures the process arguments. 3. An attacker with access to the affected history, logs, terminal recording, or process metadata retrieves the OAuth client secret. 4. The attacker uses the secret to impersonate the registered OAuth client in protocol interactions. ...[truncated 706 chars]- Remediation
View remediation