T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/dao3_statistics/cli.py:16
- Finding
- Authentication Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/dao3_statistics/cli.py`, lines 16-18 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python def _add_auth_args(parser: argparse.ArgumentParser) -> None: parser.add_argument("--token", type=str, required=True) parser.add_argument("--user-agent", type=str, required=True) ``` The documented invocation in `SKILL.md`, lines 238-245, also encourages passing the token directly on the command line: ```bash python3 -m dao3_statistics stats-player \ --start-time 2025-03-29 \ --end-time 2025-04-04 \ --map-id 100131463 \ --token "YOUR_TOKEN" \ --user-agent "Mozilla/5.0 ..." ``` ### Technical Analysis Authenticated commands accept the DAO3 token as an ordinary command-line argument. Depending on the operating system and shell configuration, command-line arguments can be: - Recorded in persistent shell history. - Exposed through process inspection interfaces while the command is running. - Captured by process-monitoring, diagnostic, audit, or job-management systems. - Retained in terminal logs or automation records. The application does not provide a safer credential-input mechanism such as hidden interactive input, a protected credential file, or an operating-system credential store. Although environment variables can also leak in some environments, they generally avoid routine shell-history and process-command-line disclosure when used carefully. ### Attack Path 1. A victim invokes an authenticated command with `--token`. 2. The token is stored in shell history or remains visible in the process argument list while the request runs. 3. A local user, monitoring process, log collector, or other principal with access to that metadata retrieves the token. 4. The attacker replays the token in the `Authorization` header when communicating with DAO3. 5. The attacke ...[truncated 907 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer hidden interactive input using `getpass.getpass()` when a token is not supplied through a secure integration. 2. Support an operating-system credential store or a protected configuration file with restrictive permissions. 3. For non-interactive operation, support a dedicated environment variable while documenting its residual exposure risks and discouraging unsafe logging. 4. Deprecate or disable `--token` by default. If compatibility requires retaining it, display an explicit warning that the value may enter shell history and process metadata. 5. Replace the token-bearing command example in `SKILL.md` with a secure-input example. 6. Ensure CI systems and automation platforms use masked secret variables and do not echo complete commands. 7. Document token revocation and rotation procedures so exposed credentials can be invalidated promptly.