T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu_send_image.sh:13- Finding
Feishu Application Secret Exposed Through Command-Line Arguments
- Content
View full analysis
[receive_id_type]}" RECEIVE_ID="${2:?Missing receive_id}" APP_ID="${3:?Missing app_id}" APP_SECRET="${4:?Missing app_secret}" RECEIVE_ID_TYPE="${5:-open_id}" ``` The documented invocation explicitly places the secret on the command line: ```bash bash scripts/feishu_send_image.sh [receive_id_type] ``` ### Technical Analysis The script requires the Feishu application secret as positional argument four. Command-line arguments are not a secure channel for secrets. Depending on the host configuration and execution environment, they may be exposed through: - Process inspection utilities and `/proc` while the script is running. - Shell command history. - Process auditing and endpoint monitoring. - Job runners, debugging output, or orchestration telemetry that records command lines. - Wrapper scripts or agent logs that preserve the invocation. The secret is legitimately needed to obtain a Feishu tenant access token, but exposing it as a process argument exceeds the minimum disclosure necessary for that operation. ### Attack Path 1. A user or agent invokes the script according to the documented command format and supplies a valid app secret. 2. A local user, monitoring component, or compromised process observes the command line while it is running or later reads retained shell/audit logs. 3. The observer extracts the Feishu app ID and app secret. 4. The observer submits those credentials to Feishu's tenant-token endpoint. 5. If the credentials remain valid, the observer invokes Feishu APIs with the permissi ...[truncated 665 chars]- Remediation
View remediation