T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/alarm_query.py:107- Finding
Sensitive credentials exposed through command-line arguments
- Content
View full analysis
Vulnerability Details
File Locations:
scripts/alarm_query.py:107-110scripts/indoor_security.py:100-104scripts/member_manager.py:223-226scripts/stats_query.py:244-247
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: MediumVulnerable Code
scripts/alarm_query.py:107-110python parser.add_argument("--uuid", required=True, help="开放平台用户 uuid") parser.add_argument("--appkey", required=True, help="应用 appKey") parser.add_argument("--secret", required=True, help="应用密钥") parser.add_argument("--auth", required=True, help="用户 token")scripts/indoor_security.py:100-104python parser.add_argument("--uuid", required=True, help="开放平台用户 uuid") parser.add_argument("--appkey", required=True, help="应用 appKey") parser.add_argument("--secret", required=True, help="应用密钥") parser.add_argument("--auth", required=True, help="用户 token (Authorization)") parser.add_argument("--movecard", type=int, default=7, help="移动卡标识（用于签名）")scripts/member_manager.py:223-226python parser.add_argument("--uuid", required=True, help="开放平台用户 uuid") parser.add_argument("--appkey", required=True, help="应用 appKey") parser.add_argument("--secret", required=True, help="应用密钥") parser.add_argument("--auth", required=True, help="用户 token")scripts/stats_query.py:244-247python parser.add_argument("--uuid", required=True, help="开放平台用户 uuid") parser.add_argument("--appkey", required=True, help="应用 appKey") parser.add_argument("--secret", required=True, help="应用密钥") parser.add_argument("--auth", required=True, help="用户 token")Technical Analysis
All four command-line interfaces require the JF application secret and authorization token to be supplied directly as process arguments. This conflicts with the environment-variable configuration documented in
SKILL.md, while the scripts do not load those documented variab ...[truncated 2877 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
--secretand--authfrom the public command-line interfaces. - Load credentials from the documented
JF_APP_SECRETandJF_AUTHORIZATIONenvironment variables, validating that they are present without including their values in error messages. - For stronger protection, support an operating-system credential store, keychain, secret manager, or permission-restricted configuration file instead of persistent plaintext environment variables.
- If interactive use is required, read secrets using a non-echoing prompt such as Python's
getpass, rather than ordinary command-line input. - Keep non-secret selectors such as device serial number and action parameters separate from authentication material.
- Ensure verbose and JSON modes never print authorization headers, signatures, application secrets, face images, or other sensitive request content. Apply explicit redaction before logging.
- Update all documentation and examples so credentials are never placed in shell commands.
- Rotate any application secrets or authorization tokens that may already have appeared in shell histories, process logs, CI logs, or terminal recordings.
- Restrict permissions on shell-history files and operational logs, and configure log-retention systems to redact known credential fields.
- Add automated tests that verify secrets cannot appear in process arguments, normal output, verbose output, exceptions, or diagnostic logs.
- Remove