T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
Plaintext cloud credentials are recommended as a persistent fallback configuration
- Content
View full analysis
> ~/.zshrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.zshrc source ~/.zshrc ``` Windows PowerShell（写入用户级环境变量）： ```powershell [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User") [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User") ``` ``` ### Technical Analysis The Skill documentation offers persistent storage of a Tencent Cloud SecretId and SecretKey in shell initialization files or user-level environment variables. These mechanisms ordinarily store the credentials in plaintext and make them available across sessions. Although the surrounding documentation warns users about this risk, presenting plaintext persistence as a supported fallback can still lead to long-lived credentials being exposed through: - Other processes running under the same user account. - Shell configuration backups and synchronization services. - Diagnostic bundles and accidental file sharing. - Malware or compromised development tools. - Child processes that inherit the complete environment. - Local users or services with permission to read the relevant profile. The SecretKey is sufficient to generate valid TC3 signatures. Its impact is therefore determined by the permissions granted to the associated Tencent Cloud identity. The Skill states that only ticket-read permissions are necessary, but it cannot technically enforce that users supply a least-privileged key. ### Attack Path 1. A user follows the documented fallback and writes the SecretId and SecretKey to `.zshrc`, `.bashrc`, or a persistent user environment variable. 2. The profile is backed u ...[truncated 940 chars]- Remediation
View remediation