T09 · Insecure Skill Coding Practices
Error
- Location
scripts/password-manager.mjs:238- Finding
Secrets Exposed Through Command-Line Arguments
- Content
View full analysis
args[i - 1] === '--name'); const type = args.find((_, i) => args[i - 1] === '--type') || 'password'; const username = args.find((_, i) => args[i - 1] === '--username'); const password = args.find((_, i) => args[i - 1] === '--password'); const tagsArg = args.find((_, i) => args[i - 1] === '--tags'); ``` The master-password change command also accepts both master passwords through arguments: ```javascript async function cmdChangePassword() { const rl = createReadline(); const oldPassword = args.find((_, i) => args[i - 1] === '--old'); const newPassword = args.find((_, i) => args[i - 1] === '--new'); if (!oldPassword || !newPassword) { console.log('❌ Missing --old or --new parameter'); console.log('Usage: password-manager change-password --old --new '); rl.close(); return; } ``` ### Technical Analysis The CLI accepts stored passwords, tokens, and old and new master passwords directly through command-line arguments. Process arguments are not a protected secret-input channel. Depending on the operating system and execution environment, they may be exposed through: - Process inspection utilities and process-monitoring APIs - Shell history - CI/CD job definitions and logs - Terminal session recording - Audit and observability systems - Parent-process telemetry - Error reports that capture complete command lines Exposure of the master password is especially severe because it permits decryption of the entire vault. Exposure of an entry password or token directly compromises that individual credential. ### Attack Path 1. A user follows the docume ...[truncated 1167 chars]- Remediation
View remediation