T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:50
- Finding
- Vault Records Exposed Through Terminal Capture## Vulnerability Details **File Location**: `SKILL.md`, lines 50–55 **Vulnerability Type**: Sensitive data exposure through terminal output capture **Risk Level**: High **Vulnerable Code**: ```bash tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'bw list items --search github' Enter # Capture output tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 ``` ### Technical Analysis The authenticated `bw list items --search github` command can return complete matching Bitwarden item objects rather than a minimal access-status result. Such records may contain passwords, usernames, authentication data, secure notes, URIs, and custom fields. The subsequent `tmux capture-pane` command extracts up to 200 lines of terminal history. In an agent-driven environment, this captured output may be returned through tool responses and consequently retained in chat transcripts, application logs, telemetry, or other execution traces. This behavior conflicts with the skill's own guardrail prohibiting secrets from being pasted into logs, chat, or code. Although capture is not inherently malicious, capturing unrestricted output from an authenticated password-vault command creates a direct sensitive-data disclosure risk. ### Attack Path 1. A user or agent follows the documented workflow and unlocks the Bitwarden vault. 2. The resulting `BW_SESSION` grants the tmux shell authenticated vault access. 3. The skill runs `bw list items --search github`. 4. Bitwarden prints matching vault records into the tmux pane. 5. `tmux capture-pane` collects the terminal output, including any sensitive fields. 6. The captured data is returned to the invoking agent or tool infrastructure. 7. Vault data may then persist in chat history, logs, telemetry, or downstream processing systems accessible to parties that do not have direct vault authorization. ### Impact Assessment Exploitation does not grant additional operating-system privileges, ...[truncated 515 chars]
- Remediation
- ## Remediation Suggestions - Do not capture terminal panes containing output from commands that return secrets or complete vault records. - Replace the access test with a non-secret operation such as `bw status`, or another command whose output cannot contain vault content. - If record retrieval is explicitly requested, obtain only the minimum necessary field and avoid returning it through chat, logs, or tool traces. - Do not use `bw list items` as a generic authentication check. - Separate secret-producing commands from diagnostic output that may be captured. - Clear pane history before diagnostic capture and terminate the tmux session immediately after use. - Apply output redaction at the tool boundary as defense in depth, while recognizing that redaction should not replace minimizing secret output. - Require explicit user authorization before retrieving passwords, TOTP values, secure notes, or complete vault items.