T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan_security.py:205- Finding
Full AppSecret Exposed Through JSON and Repair Output
- Content
View full analysis
Dict: """修复：提示用户设置环境变量""" return { "success": False, "message": "需要手动设置环境变量", "detail": f"请在 shell 配置文件中添加:\n export {fix['var_name']}='{fix['var_value']}'\n然后从 {fix['config_file']} 中删除 {fix['config_path']}" } ``` ```python if args.json: print(json.dumps(report, ensure_ascii=False, indent=2)) elif args.fix is not None: result = scanner.execute_fix(args.fix) if result['success']: print(f"✅ {result['message']}") else: print(f"⚠️ {result['message']}") if result.get('detail'): print(f" {result['detail']}") ``` ### Technical Analysis Although the human-readable finding masks the Feishu AppSecret, the scanner stores the complete secret in the `auto_fix.var_value` field. The complete report object is subsequently serialized by the `--json` mode, exposing the secret without masking. The repair path also incorporates the complete value into a shell export instruction and prints that instruction to standard output. Consequently, a security tool intended to detect sensitive-data exposure creates an additional disclosure channel. Standard output is frequently retained in terminal scrollback, CI/CD logs, monitoring systems, support transcripts, or redirected report files. Anyone wi ...[truncated 1302 chars]- Remediation
View remediation