T09 · Insecure Skill Coding Practices
Error
- Location
- PUBLISH.md:117
- Finding
- Credential-Like QQ Mail Authorization Code Exposed in Documentation<![CDATA[ ## Vulnerability Details **File Location**: `PUBLISH.md`, lines 117–118 **Vulnerability Type**: Hardcoded sensitive credential in distributed documentation **Risk Level**: High ### Vulnerable Code ```python EMAIL = "289688826@qq.com" # Delete or replace with a placeholder AUTH_CODE = "rnpaosialrosbgeh" # Delete or replace with a placeholder ``` ### Technical Analysis The publication guide contains a specific QQ Mail account together with a 16-character value explicitly represented as its authorization code. Although these values appear in an example demonstrating what should be removed, including them in a distributed project still discloses the credential. Static analysis cannot establish whether the authorization code remains valid. Nevertheless, it must be treated as compromised because anyone who obtains the project can extract and test it against QQ Mail's IMAP and SMTP services. An authorization code provides mailbox-level application access and should receive the same protection as a password. ### Attack Path 1. An attacker downloads or otherwise accesses the project package. 2. The attacker inspects `PUBLISH.md` and extracts the disclosed email address and authorization code. 3. The attacker attempts authentication against `imap.qq.com:993` or `smtp.qq.com:465`. 4. If the authorization code remains active, the attacker accesses mailbox data through IMAP or sends messages using the account through SMTP. 5. The compromised mailbox may then be used to collect sensitive correspondence or impersonate the account owner. ### Impact Assessment If the disclosed authorization code is valid, an attacker could obtain access within the permissions granted to QQ Mail IMAP/SMTP clients. Potential impact includes: - Reading mailbox messages and associated metadata through IMAP. - Accessing verification codes or other sensitive messages delivered to the mailbox. - Sending email as the affected account through SMTP. - Impersonating the mailb ...[truncated 329 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke the exposed QQ Mail authorization code and generate a replacement if the account is still in use. 2. Remove the real email address and authorization-code value from the current project and all repository history, release archives, caches, and published packages. 3. Replace the example with unmistakable non-secret placeholders: ```python EMAIL = "your_qq_number@qq.com" AUTH_CODE = "your_qq_mail_authorization_code" ``` 4. Run an automated secret scanner across the repository and its history before republishing. 5. Add pre-commit and CI checks that reject credentials, authorization codes, API keys, and other secrets. 6. Review account login and sent-mail activity for evidence of unauthorized use. 7. Rotate any other credentials that reused the same value. ]]>