T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/publish.py:17- Finding
Authenticated Browser Data Persisted in Unprotected Diagnostic Files
- Content
View full analysis
Vulnerability Details
File Location:
scripts/publish.py:17-26, 83-85, 296-301, 327-332
Vulnerability Type: Plaintext storage of sensitive authenticated page data
Risk Level: MediumVulnerable Code
python # Screenshot directory SCREENSHOT_DIR = get_subdir("screenshots")python def save_shot(page, name: str) -> str: """Save screenshot""" timestamp = time.strftime("%Y%m%d_%H%M%S") path = SCREENSHOT_DIR / f"{timestamp}_{name}.png" page.screenshot(path=str(path)) print(f"[Screenshot] {path}") return str(path)python page.goto("https://creator.xiaohongshu.com/publish/publish", timeout=30000) page.wait_for_timeout(3000) save_shot(page, "01_landing")python if not editor_ready: save_shot(page, "03c_editor_not_ready") # Dump HTML for debugging try: html = page.content() debug_path = SCREENSHOT_DIR / f"{time.strftime('%Y%m%d_%H%M%S')}_page_debug.html" debug_path.write_text(html, encoding="utf-8") print(f"[Debug] Page HTML saved to: {debug_path}") except Exception: passpython if not editor_found: print("[ERROR] Content editor not found!") save_shot(page, "04_editor_not_found") # Dump page HTML for debugging try: html = page.content() debug_path = SCREENSHOT_DIR / f"{time.strftime('%Y%m%d_%H%M%S')}_page_debug.html" debug_path.write_text(html, encoding="utf-8") print(f"[Debug] Page HTML saved to: {debug_path}") except Exception: pass raise Exception("Content editor not found")Technical Analysis
The publishing workflow runs inside an authenticated Xiaohongshu creator session. It automatically captures screenshots at multiple stages and writes the complete authenticated page DOM to disk when editor detection fails.
These diagnostic artifacts may contain account identifiers, unpublished post content, uploaded media previews, creator-page state, or other private info ...[truncated 1965 chars]
- Remediation
View remediation
Remediation Suggestions
- Make all screenshots and HTML dumps opt-in through an explicit option such as
--debug. - Disable full authenticated DOM dumps by default. Prefer narrowly scoped diagnostic metadata, such as selector states and sanitized error messages.
- Redact account identifiers, post text, image previews, tokens, URLs containing sensitive parameters, and hidden fields before saving diagnostics.
- Create diagnostic directories and files with owner-only permissions, such as
0700for directories and0600for files where supported. - Add retention controls and automatically delete diagnostics after a short configurable period.
- Warn users before capturing authenticated content and clearly identify the storage location.
- Ensure
.local/, browser profiles, screenshots, and HTML dumps are excluded from version control, cloud synchronization, and routine backups where appropriate. - Provide a cleanup command that securely removes retained screenshots, DOM dumps, and temporary browser data.
- Separate routine operational screenshots from failure diagnostics and avoid capturing pages unless the image is necessary to diagnose a specific error.
- Make all screenshots and HTML dumps opt-in through an explicit option such as