T09 · Insecure Skill Coding Practices
Error
- Location
TOOLS.md:1- Finding
Plaintext credential storage and credential disclosure through diagnostic output
- Content
View full analysis
Optional[Dict[str, str]]: """Read ZenTao credentials from TOOLS.md""" tools_path = Path(__file__).parent.parent / "TOOLS.md" if not tools_path.exists(): return None content = tools_path.read_text(encoding="utf-8") # Locate the ZenTao configuration section zentao_section_start = -1 zentao_section_end = -1 lines = content.split("\n") for i, line in enumerate(lines): if "## ZenTao API" in line or "## ZenTao" in line: zentao_section_start = i elif ( zentao_section_start >= 0 and line.strip().startswith("## ") and zentao_section_start not in [i] ): zentao_section_end = i break if zentao_section_start < 0: return None if zentao_section_end < 0: zentao_section = "\n".join(lines[zentao_section_start:]) else: zentao_section = "\n".join(lines[zentao_section_start:zentao_section_end]) endpoint = None username = None password = None for line in zentao_section.split("\n"): line = line.strip() if "API Address" in line and ":" in line: endpoint = line.split(":")[-1].strip().strip("*").strip() elif "Username" in line and ":" in line: username = line.split(":")[-1].strip().strip("*").strip() elif "Password" in line and ":" in line: password = line.split(":")[-1].strip().strip("*").strip() if endpoint and username and password: return {"endpoint": endpoint, "username": username, "password ...[truncated 1862 chars]- Remediation
View remediation