T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:34
- Finding
- Webhook Bearer Credential Exposed Through Process Arguments, Output, and Automation Prompts<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:34-38` - `SKILL.md:104-119` - `scripts/validate_webhook.py:117-119` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium **Classification**: T09: Insecure Skill Coding Practices ### Vulnerable Code `SKILL.md:34-38` instructs users to pass the webhook credential as a command-line argument: ```markdown To validate the webhook, run the validation script: ```bash python3 {SKILL_DIR}/scripts/validate_webhook.py <webhook_url_or_key> ``` ``` `SKILL.md:104-119` places the full webhook URL, including its bearer key, directly into persistent automation configuration and prompt text: ```markdown mode: "suggested create" name: <descriptive name based on content and schedule> prompt: <date guard if needed> + <content generation steps> + <push via webhook> rrule: <computed RRULE from Step 2> cwds: <current workspace> status: ACTIVE ``` **Automation prompt template:** ``` {DATE_GUARD_IF_NEEDED} 执行以下步骤： 1. {CONTENT_GENERATION_STEPS} 2. 将整理好的内容通过企业微信群机器人 Webhook 推送，Webhook 地址为：{WEBHOOK_URL} ``` `scripts/validate_webhook.py:117-119` prints the complete webhook URL after validation: ```python if result.get("errcode") == 0: print(f"✅ Webhook is valid! Response: {json.dumps(result)}") # Output the full URL for downstream use print(f"\nWEBHOOK_URL={url}") ``` ### Technical Analysis A WeChat Work webhook key functions as a bearer credential: possession of the complete URL is sufficient to submit messages to the associated group webhook. The project exposes that credential through three channels: 1. Passing the URL or key as a command-line argument can expose it through shell history, process inspection, audit telemetry, terminal recording, and command-execution logs. 2. Printing `WEBHOOK_URL={url}` discloses the complete credential to standard output, where it may be retained in CI logs, agent transcripts, job logs, or monitoring systems. 3. Embedding the complete ...[truncated 1988 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove secrets from command-line arguments** - Accept webhook credentials through protected standard input, an environment variable supplied by a secret manager, or a credential-file descriptor. - Avoid documenting commands that place the key directly in shell history. - If a credential file is supported, require restrictive permissions and reject files accessible to other users where feasible. 2. **Never print the complete webhook URL** - Remove `print(f"\nWEBHOOK_URL={url}")`. - Return only a success indicator or a masked identifier such as the first eight and last four key characters. - Apply centralized redaction to errors, debug output, and structured logs. 3. **Use secret references in automation configuration** - Store the webhook URL in an approved encrypted secret store. - Put only a secret identifier in the automation prompt, such as `WECHAT_WEBHOOK_SECRET_ID`. - Resolve the secret only at execution time and prevent its value from being included in prompts, tool output, task exports, or logs. 4. **Reduce exposure and rotate affected credentials** - Rotate webhook keys that have already appeared in logs, command histories, transcripts, or automation prompts. - Remove historical plaintext values from retained logs and task configurations where possible. - Restrict access to automation definitions and execution logs according to least privilege. 5. **Add automated secret-leakage tests** - Test that successful validation output never contains the supplied key. - Test automation serialization and logging paths to ensure credentials are redacted. - Add a repository rule preventing full webhook URLs or bearer keys from being included in examples, logs, or persisted prompt templates. ]]>