T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:38
- Finding
- Plaintext and Unnecessary Collection of High-Value Smart-Home Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-56; `platforms/xiaomi.js`, lines 7-12 and 27-33; `platforms/homekit.js`, lines 7-12 **Vulnerability Type**: Plaintext sensitive-data storage and unnecessary credential collection **Risk Level**: High ### Evidence `SKILL.md` directs users to place account passwords, device tokens, Apple IDs, and HomeKit PINs directly into a Markdown file: ```markdown ### 3. 配置凭证 在 `TOOLS.md` 中添加配置： ```markdown ### Smart Home - 智能家居配置 #### 小米米家 - xiaomi: - username: "你的小米账号" - password: "你的小米密码" - device_token: "设备 token（通过 miio extract 获取）" #### Apple HomeKit - homekit: - pin_code: "配件 PIN 码（8 位数字，格式：XXX-XX-XXX）" - username: "Apple ID（可选，用于 iCloud 同步）" - password: "Apple 密码（可选）" ``` ``` The Xiaomi adapter retains all credentials in ordinary JavaScript object properties: ```javascript class XiaomiAdapter { constructor(config) { this.username = config.username; // 小米账号 this.password = config.password; // 小米密码 this.token = config.device_token; // 设备 token（可选，本地控制需要） this.devices = new Map(); } } ``` The purported login requires the Xiaomi username and password, but the actual connection only uses the device token: ```javascript if (!this.username || !this.password) { throw new Error('请配置小米账号和密码'); } // 发现并连接设备 const device = await miio.device({ address: '192.168.1.100', token: this.token }); this.devices.set('gateway', device); ``` The HomeKit adapter similarly retains Apple credentials even though no code uses them for authentication or iCloud synchronization: ```javascript class HomeKitAdapter { constructor(config) { this.username = config.username; // Apple ID（可选，用于 iCloud 同步） this.password = config.password; // Apple 密码（可选） this.pinCode = config.pin_code; // HomeKit PIN 码（必需） this.accessories = new Map(); } } ``` ### Technical Analysis `TOOLS.md` is a general Markdown configuration document rather than a dedic ...[truncated 2132 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove Xiaomi username and password requirements unless a genuine cloud authentication flow is implemented and documented. 2. Remove Apple ID and Apple password fields. Local HomeKit support must not request cloud-account credentials. 3. Store device tokens and PINs in an operating-system credential manager, encrypted secret vault, or platform-provided secret facility rather than `TOOLS.md`. 4. If file-based storage is unavoidable: - Use a dedicated secrets file outside the project directory. - Enforce owner-only permissions. - Exclude it from version control and backups by default. - Encrypt secrets at rest using a key not stored beside the ciphertext. 5. Avoid retaining secrets as long-lived public object properties. Load them only when required, minimize their lifetime, and clear references after use. 6. Add secret-redaction controls to logs, exceptions, diagnostics, and support bundles. 7. Document exactly which credentials are needed, why they are needed, where they are stored, and which network endpoints receive them. 8. Rotate any credentials that users may already have placed in `TOOLS.md`. ]]>