T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Plaintext Secrets Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 25-26 **Vulnerability Type**: Plaintext sensitive data exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Store a new secret ./scripts/vault-ops.sh --store --key "db_password" --value "secret" ``` ### Technical Analysis The documented storage command supplies the secret through the `--value` command-line argument. Command-line arguments are not an appropriate channel for sensitive values because they can be retained in shell history and may be exposed through process inspection, diagnostic utilities, audit systems, terminal logging, or process-monitoring software. This usage directly conflicts with the stated purpose of protecting secrets. Although the current script ignores `--value`, users following the documented interface still expose the plaintext value before the script processes it. ### Attack Path 1. A user follows the documented example and invokes `vault-ops.sh` with a production secret in `--value`. 2. The shell may retain the complete command in its history file. 3. While the process is running, an authorized local observer or monitoring tool may capture its argument list. 4. Diagnostic, audit, or terminal logs may retain the command after execution. 5. An attacker who later obtains access to one of these records can recover and reuse the plaintext credential. ### Impact Assessment Exploitation can disclose any password, API token, database credential, or configuration secret supplied using the documented interface. The flaw does not itself provide privilege escalation; the attacker's resulting privileges are those granted by the exposed credential. Consequently, scope ranges from access to a single application account to broader database, API, or production-system access, depending on the secret involved.
- Remediation
- ## Remediation Suggestions - Remove the `--value` command-line option and all examples that place secrets in process arguments. - Read interactive secrets with terminal echo disabled, such as through `read -r -s`. - For automation, accept the secret through a protected file descriptor or standard input, with clear warnings concerning pipelines and logging. - Avoid storing submitted plaintext in shell variables longer than necessary, and unset sensitive variables after use. - Ensure logs and error messages never include secret values. - Document secure, history-safe examples and explain the security properties of each supported input mechanism. - Add automated tests confirming that secret values do not appear in process arguments or program output.