T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:80
- Finding
- PDF Passwords Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:80-92`; `references/pdftk-cli-examples.md:20-44`, `references/pdftk-cli-examples.md:90-94`, and `references/pdftk-cli-examples.md:120-124`; `references/pdftk-man-page.md:34-37` **Vulnerability Type**: Sensitive information exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:80-84 # Set an owner password and a user password with 128-bit encryption (default): pdftk input.pdf output secured.pdf owner_pw mypassword user_pw userpass ``` ```bash # SKILL.md:88-92 # Remove encryption using the known password: pdftk secured.pdf input_pw mypassword output unsecured.pdf ``` ```bash # references/pdftk-cli-examples.md:20-44 pdftk secured.pdf input_pw foopass output unsecured.pdf pdftk 1.pdf output 1.128.pdf owner_pw foopass pdftk 1.pdf output 1.128.pdf owner_pw foo user_pw baz pdftk 1.pdf output 1.128.pdf owner_pw foo user_pw baz allow printing ``` ```bash # references/pdftk-cli-examples.md:90-94 pdftk A=secured.pdf 2.pdf input_pw A=foopass cat output 3.pdf ``` ```bash # references/pdftk-cli-examples.md:120-124 pdftk in.pdf burst owner_pw foopass allow DegradedPrinting ``` ```bash # references/pdftk-man-page.md:34-37 pdftk A=secured.pdf input_pw A=foopass cat output unsecured.pdf ``` ### Technical Analysis The documented workflows place PDF owner passwords, user passwords, and decryption passwords directly in command-line arguments. Although the examples use placeholders, users are expected to replace them with real secrets. Command-line secrets can be exposed through: - Shell history files and terminal session logs. - Process inspection utilities while PDFtk is running. - System monitoring, auditing, telemetry, or job-execution logs that record complete command lines. - CI/CD logs or automation output if the examples are incorporated into scripts. - Shared terminal history or diagnostic bundles. This is a local information-disclosure ...[truncated 1145 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer PDFtk's interactive `PROMPT` mechanism where the installed PDFtk variant supports it, so passwords are not included in the command line. 2. Add a prominent warning that real passwords must not be placed directly in shell commands, scripts, CI configuration, or terminal transcripts. 3. If command-line password arguments are unavoidable: - Temporarily disable shell history before running the command. - Ensure history is restored afterward. - Run the operation only on a trusted, single-user system. - Prevent automation and monitoring systems from logging the complete command line. 4. Avoid storing passwords in plaintext environment variables, as these may also be observable in process environments or logs. 5. Recommend unique, randomly generated PDF passwords to reduce the effect of disclosure or reuse. 6. Replace all examples containing password-like literals with interactive examples and clearly mark any argument-based form as a compatibility fallback with security limitations. ]]>