T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/scan_security.py:205
- Finding
- Full AppSecret Exposed Through JSON and Repair Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan_security.py`, lines 205–214, 593–603, and 738–745 **Vulnerability Type**: Plaintext sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```python self._add_finding({ "category": "配置权限", "risk": RISK_MEDIUM, "issue": "飞书 AppSecret 存储在配置文件中", "detail": f"AppSecret: {secret_value[:8]}...{secret_value[-4:]}", "suggestion": "将 appSecret 移至环境变量", "auto_fix": { "type": "env_var", "var_name": "FEISHU_APP_SECRET", "var_value": secret_value, "config_path": "feishu.appSecret", "config_file": str(config_file) } }) ``` ```python def _fix_env_var(self, fix: Dict) -> Dict: """修复：提示用户设置环境变量""" return { "success": False, "message": "需要手动设置环境变量", "detail": f"请在 shell 配置文件中添加:\n export {fix['var_name']}='{fix['var_value']}'\n然后从 {fix['config_file']} 中删除 {fix['config_path']}" } ``` ```python if args.json: print(json.dumps(report, ensure_ascii=False, indent=2)) elif args.fix is not None: result = scanner.execute_fix(args.fix) if result['success']: print(f"✅ {result['message']}") else: print(f"⚠️ {result['message']}") if result.get('detail'): print(f" {result['detail']}") ``` ### Technical Analysis Although the human-readable finding masks the Feishu AppSecret, the scanner stores the complete secret in the `auto_fix.var_value` field. The complete report object is subsequently serialized by the `--json` mode, exposing the secret without masking. The repair path also incorporates the complete value into a shell export instruction and prints that instruction to standard output. Consequently, a security tool intended to detect sensitive-data exposure creates an additional disclosure channel. Standard output is frequently retained in terminal scrollback, CI/CD logs, monitoring systems, support transcripts, or redirected report files. Anyone wi ...[truncated 1302 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `var_value` from the report and all `auto_fix` structures: ```python "auto_fix": { "type": "env_var", "var_name": "FEISHU_APP_SECRET", "config_path": "feishu.appSecret", "config_file": str(config_file) } ``` 2. Never include complete credentials in JSON, terminal output, logs, exception messages, or repair summaries. 3. Change `_fix_env_var()` to print only a placeholder: ```python "detail": ( f"Set {fix['var_name']} using a secure prompt or secret manager, " f"then remove {fix['config_path']} from {fix['config_file']}." ) ``` 4. If automated migration is required, obtain the value through a non-echoing prompt and pass it directly to a trusted secret manager without adding it to the report object. 5. Add recursive output sanitization before JSON serialization so fields containing secret-like values cannot be emitted accidentally. 6. Add regression tests confirming that known test secrets never appear in output from `--json`, `--fix`, `--fix-all`, or `--interactive`. ]]>