T09 · Insecure Skill Coding Practices
- Location
scripts/create-user.sh:35- Finding
Account Password Exposed in Process Arguments and Dry-Run Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/create-user.sh, lines 35-60
Vulnerability Type: Credential exposure through command-line arguments and diagnostic output
Risk Level: HighVulnerable Code
bash PASSWORD="${!PASSWORD_ENV:-}" if [[ -z "$PASSWORD" ]]; then echo "password env is empty: $PASSWORD_ENV" >&2 exit 1 fi if dscl . -read "/Users/$USER_NAME" >/dev/null 2>&1; then echo "user already exists: $USER_NAME" >&2 exit 1 fi create_cmd=(sudo sysadminctl -addUser "$USER_NAME" -fullName "$FULL_NAME" -shell "$SHELL_PATH" -password "$PASSWORD") if [[ "$DRY_RUN" == "yes" ]]; then printf '%q ' "${create_cmd[@]}" echo if [[ "$ADMIN" == "yes" ]]; then echo "sudo dseditgroup -o edit -a \"$USER_NAME\" -t user admin" fi echo "sudo -u \"$USER_NAME\" mkdir -p \"/Users/$USER_NAME/.ssh\" \"/Users/$USER_NAME/.openclaw\"" echo "sudo -u \"$USER_NAME\" chmod 700 \"/Users/$USER_NAME/.ssh\"" echo "sudo -u \"$USER_NAME\" /bin/zsh -lc 'grep -q /opt/homebrew/bin ~/.zprofile 2>/dev/null || printf \"\\nexport PATH=/opt/homebrew/bin:/opt/homebrew/sbin:\\$PATH\\n\" >> ~/.zprofile'" exit 0 fi "${create_cmd[@]}"Technical Analysis
Although the password is initially supplied through an environment variable, the script copies it into the argument vector of
sysadminctlusing-password "$PASSWORD".In normal execution, the plaintext password may consequently be exposed through local process inspection, process accounting, endpoint monitoring, command auditing, or diagnostic collection. The exact visibility of another process's arguments depends on macOS permissions and timing, but secrets should not be placed in command-line arguments.
The dry-run behavior creates a more direct disclosure:
printf '%q ' "${create_cmd[@]}"prints every argument increate_cmd, including the plaintext account password. Dry-run output may be stored in terminal scrollback, C ...[truncated 1447 chars]- Remediation
View remediation
Remediation Suggestions
- Do not place passwords in command-line argument arrays.
- Use a supported interactive or standard-input password mechanism, such as
sysadminctl -password -, where practical. - Ensure the secret is supplied directly to the intended process without echoing it or embedding it in generated shell text.
- In dry-run mode, print a redacted placeholder such as
-password [REDACTED]rather than the actual value. - Avoid retaining the password in shell variables longer than necessary and unset it immediately after use.
- Document that execution logs, tracing such as
set -x, and terminal recording must not capture secrets. - Add an automated test asserting that dry-run output never contains the supplied password.