T09 · Insecure Skill Coding Practices
- Location
SKILL.md:105- Finding
Grass Session Token Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 105–112
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: MediumVulnerable Code Snippet:
text ## Grass.io Setup Getting your session token: 1. Login at app.getgrass.io in Chrome 2. Open DevTools → Application → Local Storage → app.getgrass.io 3. Copy `userId` and `accessToken` values 4. Paste into `passive-income-tracker add-app grass --token <accessToken>` > Note: Grass.io doesn't have an official public API. This skill uses the same endpoints as the web dashboard. Token may expire; re-auth if earnings show as 0.Technical Analysis
The documented workflow instructs users to extract an authenticated Grass access token from browser storage and pass it to the tracker as a command-line argument. Command-line credentials can be exposed through process inspection, shell tracing, command auditing, diagnostic collection, application error logs, terminal history, or wrapper scripts that record invocations.
The token is also intended for use with unofficial dashboard endpoints rather than a documented, scoped public API. Consequently, its effective permissions and revocation behavior cannot be established from the supplied project files. The package contains no implementation that would allow verification of token redaction, secure storage, destination validation, TLS enforcement, or the claim that credentials are encrypted at rest.
Network access is necessary for the declared earnings-tracking functionality, but collecting a browser session credential through a process argument exceeds the safest minimum mechanism for providing that credential.
Attack Path
- A user follows the documented setup procedure and retrieves the Grass
accessTokenfrom browser local storage. - The user invokes
passive-income-tracker add-app grass --token .... - A local process, process-monitoring servic ...[truncated 1005 chars]
- A user follows the documented setup procedure and retrieves the Grass
- Remediation
View remediation
Remediation Suggestions
- Do not accept session credentials directly through command-line arguments.
- Prefer a scoped, official API credential if the provider makes one available.
- Accept the token through interactive hidden input, an OS credential manager, or a protected credential file referenced by path.
- If environment-variable input is supported, document its residual exposure risks and ensure subprocesses and diagnostics do not inherit or record the value unnecessarily.
- Redact tokens from logs, exceptions, telemetry, process output, exported configuration, and support bundles.
- Store credentials using authenticated encryption with keys held outside the same plaintext configuration and restrict relevant files to the owning user.
- Validate that requests are sent only to an allowlisted Grass HTTPS origin, reject redirects to untrusted origins, and apply certificate verification.
- Document token scope, expiration, rotation, and revocation procedures.
- Add tests confirming that tokens never appear in logs, status output, process arguments, or exports.