T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:63
- Finding
- TeamCycle Password Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Exposure of authentication credentials through process arguments **Risk Level**: Medium ### Vulnerable Code The documented command has the following structure, with the password supplied as its second positional argument: ```shell python scripts/bug_reporter.py zhanju.zhang "PASSWORD" 58 "BUG_TITLE" "HTML_BUG_DESCRIPTION" 211 "PRIORITY" "PHASE" ``` ### Technical Analysis The documented invocation requires a TeamCycle password to be entered directly into a command-line argument. Command-line arguments are not an appropriate channel for authentication secrets because they may be exposed through: - Shell history files. - Process listings and process-monitoring utilities. - Terminal-session recording. - Endpoint telemetry and audit logs. - Wrapper scripts or automation logs that record the complete command. - Error reports that include the invoked command. Although the password shown in the documentation is a placeholder rather than a hardcoded credential, users following the documented workflow are instructed to replace it with a real password. This creates a concrete credential-disclosure risk. ### Attack Path 1. A user follows the documented example and replaces the password placeholder with a valid TeamCycle password. 2. The user executes the command in a terminal or through an automation system. 3. The complete command is retained in shell history, captured by process telemetry, or temporarily exposed through process inspection. 4. A local user, monitoring-system operator, compromised process, or party with access to collected logs retrieves the password. 5. The exposed credentials are used to authenticate to TeamCycle as the affected user. ### Impact Assessment Successful exploitation exposes the TeamCycle account credentials of the user invoking the Skill. The resulting privileges are limited to those assigned to ...[truncated 244 chars]
- Remediation
- ## Remediation Suggestions - Do not accept passwords through positional command-line arguments. - Retrieve credentials from an operating-system credential manager, managed secret store, or protected runtime secret injection mechanism. - For interactive use, request the password through a hidden-input prompt that disables terminal echo. - If an environment variable is unavoidable, ensure it is injected only at runtime, is never logged, and is removed immediately after use. A managed secret store remains preferable. - Replace password-based authentication with a narrowly scoped API token when TeamCycle supports it. - Ensure tokens have the minimum permissions necessary to create defects and have short expiration periods where possible. - Redact secrets from application logs, exception messages, telemetry, and debugging output. - Update the documentation so examples contain no workflow that instructs users to place credentials on the command line. - Advise users who have already followed this workflow to remove affected shell-history entries and rotate the exposed password.