T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
Zhihu Credentials Exposed Through Process Arguments
- Content
View full analysis
" "fill @e40 <密码>" "click @e12" ``` > ⚠️ 账号密码通过用户输入获取，**禁止写死到文件中**。 ``` ### Technical Analysis The documented workflow substitutes the user's Zhihu account name and plaintext password directly into the arguments of a `node xb.cjs` process. Although the instructions prohibit hardcoding credentials in files, passing a password as a command-line argument does not adequately protect it. Depending on the host operating system and execution environment, command arguments may be exposed through: - Process inspection utilities available to other local users or processes. - Parent-process telemetry and endpoint monitoring. - Automation framework logs. - Shell command history if the command is issued interactively. - Debugging, crash-reporting, or process-auditing facilities. - Error messages generated by the invoked browser automation tool. Quoting the password does not prevent disclosure because it remains part of the process argument vector. ### Attack Path 1. A user supplies valid Zhihu credentials to the agent. 2. The agent constructs the documented command with the plaintext password embedded in the `fill @e40` argument. 3. The operating system creates the `node xb.cjs` process with that argument available in its process metadata. 4. A local user, monitoring process, logging component, or compromised process captures the command arguments. 5. The exposed credentials are used to access the victim's Zhihu account. ### Impact Assessment Successful exploitation discloses the user's Zhihu login credentials. An ...[truncated 439 chars]- Remediation
View remediation