T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/check_load.py:45
- Finding
- Exposure of Sensitive Process Command-Line Arguments## Vulnerability Details **File Location**: `scripts/check_load.py`, lines 45-64 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```python def get_top_processes(limit=5): """Get top processes by CPU usage""" try: result = subprocess.run( ['ps', 'aux', '--sort=-%cpu'], capture_output=True, text=True, timeout=5 ) lines = result.stdout.strip().split('\n')[1:limit+1] processes = [] for line in lines: parts = line.split() if len(parts) >= 11: processes.append({ "user": parts[0], "cpu_percent": float(parts[2]), "mem_percent": float(parts[3]), "command": ' '.join(parts[10:]) }) return processes except Exception as e: return [{"error": str(e)}] ``` ### Technical Analysis The script invokes `ps aux`, which enumerates processes system-wide and includes their complete command-line arguments. It then copies those arguments into the `command` field of the returned result. Command-line arguments can contain API tokens, passwords, database connection strings, signed URLs, private paths, or other confidential values. The collected data is exposed through the script's JSON output and can subsequently enter agent transcripts, application logs, monitoring systems, or notification channels. Full process arguments are not required to determine CPU or memory load. Consequently, their collection and disclosure exceed the minimum information necessary for the skill's stated purpose. ### Attack Path 1. A process is started with a sensitive value in its command-line arguments, such as an API token or database password. 2. The process consumes enough CPU to appear among the five highest-CPU processes. 3. A user or automated agent inv ...[truncated 882 chars]
- Remediation
- ## Remediation Suggestions 1. Remove complete command-line arguments from the output. 2. Report only the minimum necessary process metadata, such as PID, CPU percentage, memory percentage, and executable name. 3. Prefer a command that does not expose arguments, or read a sanitized executable name from an appropriate system interface. 4. Where feasible, restrict process enumeration to processes owned by the current user. 5. If arguments must be retained for a justified use case, implement strict allowlisting and redact tokens, passwords, authorization headers, connection strings, URLs containing credentials, and other credential-like values. 6. Treat monitoring output as sensitive and prevent it from being written to public logs or unrestricted notification channels. 7. Add tests using synthetic secrets in process arguments to verify that generated output never includes those values.