T09 · Insecure Skill Coding Practices
Error
- Location
config/default.json:2- Finding
Hardcoded WeChat API credentials stored in the repository
- Content
View full analysis
Date.now()) return tokenCache.token; const account = getWempAccount(); const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${account.appId}&secret=${account.appSecret}`; const resp = await fetch(url); const data = await resp.json(); if (data.errcode) throw new Error(`获取 Token 失败: ${data.errcode} - ${data.errmsg}`); tokenCache = { token: data.access_token, expiresAt: Date.now() + (data.expires_in - 300) * 1000 }; return tokenCache.token; } ``` ### Technical Analysis A non-placeholder WeChat AppID and 32-character AppSecret are committed directly to a distributable configuration file. Every person or system with access to the package can read the secret without bypassing any access control. The network request itself is consistent with the declared WeChat integration and targets the official `api.weixin.qq.com` service. The vulnerability is the exposure and distribution of the credential, not covert exfiltration by that request. Repository deletion alone is insufficient if the value has already been published, cached, mirrored, or ret ...[truncated 1032 chars]- Remediation
View remediation