T09 · Insecure Skill Coding Practices
Error
- Location
- secrets-manager.js:440
- Finding
- Audit Command Discloses Plaintext Secret Prefixes<![CDATA[ ## Vulnerability Details **File Location**: `secrets-manager.js:440-444, 460-465` **Vulnerability Type**: Plaintext sensitive-data exposure through logs **Risk Level**: High ### Vulnerable Code ```js if (value.length < 8) { findings.weak.push({ name, length: value.length }); } if (/^(password|admin|root|test|demo|secret|key|token)/i.test(value)) { findings.patterns.push({ name, pattern: value.substring(0, 10) + '...' }); } ``` ```js if (findings.patterns.length > 0) { hasIssues = true; console.log(`\n ⚠️ Weak patterns (${findings.patterns.length}):`); for (const f of findings.patterns) { console.log(` ⚠️ ${f.name}: starts with '${f.pattern}'`); } } ``` ### Technical Analysis The audit operation decrypts every stored secret and, when a value begins with a recognized weak prefix, stores the first ten plaintext characters in the audit result. It subsequently writes those characters to stdout. This violates the documented guarantee that secret values are not logged. The appended `...` does not constitute safe masking: ten characters can disclose an entire short credential or a substantial, operationally useful portion of a longer token. Audit output may be retained in terminal scrollback, agent transcripts, CI logs, journald, or centralized logging systems. ### Attack Path 1. A secret beginning with `password`, `admin`, `root`, `test`, `demo`, `secret`, `key`, or `token` is stored. 2. A user, agent heartbeat, or automated task invokes `--audit`. 3. `auditSecrets()` decrypts the secret. 4. The first ten plaintext characters are written to stdout. 5. An actor with access to captured output or logs obtains credential material. ### Impact Assessment The vulnerability exposes up to ten plaintext characters from affected secrets to every system or user that can observe audit output. For short secrets this may disclose the complete meaningful value. For longer credentials, the disclosed prefix may assist credential identification, ...[truncated 221 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never place plaintext secret fragments in audit findings or output. - Report only non-sensitive attributes, such as the detected pattern class, secret length, and remediation guidance. - Replace the vulnerable result with data such as: ```js findings.patterns.push({ name, pattern: 'common-prefix' }); ``` - If correlation is required, use a keyed, non-reversible fingerprint and do not expose the key. - Add automated tests that capture stdout and verify that neither complete secrets nor any substring of them appears in audit output. - Review existing audit logs and agent transcripts for previously disclosed credential fragments, then rotate affected credentials. ]]>