T09 · Insecure Skill Coding Practices
Error
- Location
README.md:39- Finding
Plaintext X/Twitter credentials exposed through agent conversations, command-line arguments, and configuration files
- Content
View full analysis
"Install x-cli from https://github.com/ignsoftwarellc/x-cli — my X username is **your_username**, password is **your_password**." ``` `README.md:52-69` recommends passing the password on the command line or storing it in plaintext configuration: ```markdown ### Option 1: Login with credentials ```bash python scripts/x_auth.py login --username your_user --password your_pass ``` ### Option 2: Use existing cookies If you already have a `cookies.json` file (e.g. from a browser export), place it in the project root. ### Option 3: Set credentials in config.json ```json { "x_username": "your_username", "x_email": "your_email@example.com", "x_password": "your_password", "cookies_file": "cookies.json", "proxy": null, "language": "en-US" } ``` ``` `config.example.json:1-8` establishes plaintext password storage as a supported default configuration pattern: ```json { "cookies_file": "cookies.json", "proxy": null, "x_username": "", "x_email": "", "x_password": "", "language": "en-US" } ``` `scripts/x_auth.py:58-84` reads the password from either a command-line argument or plaintext configuration and then saves authenticated cookies: ```python async def cmd_login(args): config = load_config() username = args.username or config.get("x_username") password = args.password or config.get("x_password") email = args.email or config.get("x_email", username) if not usern ...[truncated 4567 chars]- Remediation
View remediation